d-base[.]app

The domain d-base.app has been identified as a brand impersonation phishing site specifically targeting users of the Base blockchain platform. Analysis confirms this domain was actively engaged in fraudulent activity designed to mimic legitimate Base services, likely for credential harvesting or cryptocurrency theft. As of the latest verification, the domain has been taken offline, though residual risks may persist through cached content or secondary distribution channels. Infrastructure analysis reveals the domain was registered through IONOS SE on May 29, 2024, and resolved to the IP address 212.132.109.174. Security telemetry indicates the domain was flagged by 5 of 95 vendors in VirusTotal scans, while appearing on at least one security blocklist. The hosting environment employed Plesk and Nginx web server technologies, with a Let's Encrypt SSL certificate deployed for encryption. Additional threat intelligence confirms its presence in one AlienVault OTX pulse, while Gridinsoft assigned a trust score of 0 out of 100. The page title was identical to the domain name, further suggesting minimal effort to disguise its fraudulent nature. Current status indicates the domain is no longer active, though historical DNS records and cached content may still pose risks. Organizations and individuals are advised to implement proactive measures, including the addition of this domain to internal blocklists and monitoring for related subdomains or newly registered lookalike domains. Users who may have interacted with this domain should immediately revoke any active sessions, rotate credentials, and monitor financial transactions for unauthorized activity. Security teams are encouraged to review logs for connections to 212.132.109.174 and correlate with other known phishing indicators associated with blockchain impersonation campaigns.