zenbase-migration[.]com

Analysis of zenbase-migration.com shows that the domain was registered on 21 February 2026 and is presently taken offline. The site presents the page title “ZEN Migration Claim Portal Testnet”, which aligns with the reported scam type of wallet/seed phishing targeting the Base brand. The domain resolves to 172.67.159.9, an address owned by Cloudflare, Inc. (AS13335) located in the United States, indicating the use of a reputable CDN for hosting. The SSL certificate presented is identified as WE1, which is valid but does not mitigate the malicious intent. VirusTotal scans have recorded 12 detections out of 93 security vendors, confirming that a notable subset of scanners consider the domain malicious.

The domain appears on one external security blocklist and has been specifically blocked by PhishDestroy, demonstrating that at least one dedicated anti‑phishing service has taken action. Additionally, Gridinsoft assigns a trust score of 0 out of 100, reinforcing the classification as a high‑risk resource. The combination of brand impersonation, wallet/seed phishing, and the observed detection metrics suggests a coordinated attempt to harvest cryptocurrency credentials. Uncertainty remains regarding the full scope of the phishing infrastructure, such as any additional command‑and‑control servers, the presence of malicious payloads, or the exact content delivered to victims, because no detailed page content analysis is available.

Defenders should treat any traffic to or from zenbase-migration.com as hostile. Network security devices should block the domain and its resolved IP address, and threat‑intel feeds should be updated to include the domain, its SSL fingerprint, and the associated blocklist entries. Incident response teams should monitor for attempts to submit wallet seeds or private keys that reference the Base brand, and educate users that the “ZEN Migration Claim Portal Testnet” page is a fraudulent lure.