base55[.]app

The domain base55.app is flagged for brand impersonation, specifically targeting the brand 'base'. No known drainer kits were identified in the analysis.

Infrastructure analysis reveals that base55.app has a VirusTotal score of 9/95, indicating some level of suspicion among security vendors. The domain is registered through Cloudflare, Inc., and resolves to the IP address 216.198.79.67, which is located in the United States under the AS16509 network operated by Amazon.com, Inc. The domain was created on November 29, 2025, and appears on one security blocklist. It is also blocked by PhishDestroy. The SSL certificate for the domain is issued by Let's Encrypt, using the R13 certificate authority. The page title for the domain is 'BASE 55 | Base de Fornecedores', further supporting the impersonation of the 'base' brand.

The domain is currently offline, which suggests that the threat has been mitigated to some extent. However, the fact that it was actively used for brand impersonation and has been flagged by multiple security vendors indicates an elevated risk level. Response actions should include continued monitoring for any reactivation of the domain, and users should be vigilant and avoid clicking on any links or providing sensitive information to sites that appear suspicious. Despite the domain being offline, the infrastructure and methods used in this threat could be replicated, and the risk remains for similar future attacks.