basesafepay[.]com

The domain basesafepay.com has been identified as an active brand impersonation phishing site targeting Across, a recognized payment infrastructure provider. Analysis indicates the site presents itself as an online payment gateway and e-wallet, a common tactic to deceive users into submitting sensitive financial credentials or personal information. The domain remains operational as of the latest verification, posing a high risk to individuals and organizations interacting with payment-related services. Infrastructure analysis reveals the domain was registered on December 4, 2023, through NameSilo, LLC, a registrar frequently associated with malicious domains due to its low-cost and minimal verification processes. The domain resolves to the IP address 148.72.153.209, hosted on AS30083 (velia.net) in the United States. Detection metrics indicate the domain is flagged by 6 of 95 security vendors on VirusTotal, while appearing on a single blocklist, specifically PhishDestroy. Notably, the domain lacks an SSL certificate, a critical security indicator that heightens the risk of data interception during transmission. The page title, 'basesafepay – Online Payment Gateway & E-Wallet,' directly mimics legitimate payment service branding to enhance credibility. Current threat assessment classifies basesafepay.com as high-risk due to its active status, brand impersonation tactics, and technical indicators of compromise. Organizations and end-users are advised to block the domain at the network level and implement DNS-based filtering to prevent access. Financial institutions and payment service providers should issue alerts to customers regarding this impersonation attempt. Users who may have interacted with the domain are urged to reset credentials on legitimate platforms and monitor accounts for unauthorized activity. Continuous monitoring of associated infrastructure, including the IP address 148.72.153.209, is recommended to identify potential pivot domains or secondary attack vectors.