base[.]app[.]br

Analysis of the domain base.app.br, observed on July 23, 2026, indicates a high‑risk brand‑impersonation campaign targeting the brand “base.” The domain was registered on September 06, 2025 and currently resolves to the IP address 172.67.181.230, which belongs to AS13335 Cloudflare, Inc. in the United States. Infrastructure examination shows the domain is hosted behind Cloudflare’s nameservers (eleanor.ns.cloudflare.com and quinton.ns.cloudflare.com) and does not present an SSL/TLS certificate, leaving the connection unencrypted. The site’s page title is reported simply as “BASE,” matching the targeted brand, and the MX record list is empty, suggesting no email services are configured.

Threat intelligence flags the domain on a single security blocklist and records a Gridinsoft trust score of 0 out of 100, reflecting a lack of confidence in its legitimacy. Google Safe Browsing classifies the URL as social engineering, and VirusTotal reports that 15 of 93 scanning engines flag the domain, reinforcing the suspicion of malicious activity. The campaign is further corroborated by an AlienVault OTX pulse that includes the domain in one threat‑intel feed, and PhishDestroy has explicitly blocked the site.

While the domain is currently offline, the combination of brand impersonation, the “Crypto Scam” label, multiple vendor detections, and the absence of TLS protection point to a deliberate attempt to deceive users for financial gain. Defenders should continue to block the domain at network perimeters, monitor for any re‑hosting attempts, and advise users to avoid interacting with URLs that reference base.app.br, especially any unsolicited messages that reference cryptocurrency transactions or request credentials related to the “base” brand.