zenbase-migration[.]org

The domain zenbase-migration.org was registered on 21 February 2026 and is currently resolved to the Cloudflare address 104.21.50.74, which is associated with ASN 13335 in the United States. The site presents the page title “ZEN Migration Claim Portal Testnet”, indicating a claim portal that is likely intended to lure cryptocurrency users. Intelligence classifies the activity as a wallet/seed phishing operation that impersonates the brand “base”. VirusTotal analysis shows that 13 out of 93 scanning engines flagged the domain, reflecting a mixed but notable detection rate.

The domain is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy service. Additional reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 out of 100, and the SSL certificate is identified only as “WE1”, offering no additional validation of legitimacy. The site has been taken offline at the time of reporting, and its HTTP status returns no content. The available evidence points to a deliberately crafted infrastructure designed to harvest cryptocurrency wallet seeds under the guise of a migration claim.

However, the limited number of blocklist entries and the relatively low VirusTotal detection count leave some uncertainty about the full scale of the campaign and whether additional domains share the same backend. Defenders should continue to monitor the IP address 104.21.50.74 for any re‑activation or new hostnames, enforce outbound filtering of connections to this address, and update internal blocklists to include zenbase-migration.org. Given the low trust score and the presence on PhishDestroy, any email or messenger content referencing a “ZEN Migration Claim Portal” should be treated as malicious. Continuous threat‑intel feeds should be consulted for any resurgence or related domains that may appear.