base-counter-app[.]vercel[.]app

Analysis of base-counter-app.vercel.app indicates an active brand‑impersonation infrastructure targeting the Base brand. The domain was created on 28 January 2020 and is registered through Vercel Inc., using Vercel’s DNS service (ns1.vercel-dns-3.com ns2.vercel-dns-3.com ns3.vercel-dns-3.com ns4.vercel-dns-3.com). The site resolves to the Amazon Web Services IP 216.198.79.67, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WR1 intermediate, confirming a valid HTTPS endpoint, while HTTP requests return status 200 and the page title is "Base Counter". Detected technologies include Vercel hosting and HTTP Strict Transport Security (HSTS).

A Gridinsoft trust score of 0/100 suggests a malicious reputation. The domain appears on one security blocklist and has been flagged by PhishDestroy. VirusTotal analysis shows that 1 of 93 scanning engines identified the domain as malicious. The site is classified as a wallet/seed phishing campaign, specifically attempting to harvest cryptocurrency seed phrases under the guise of a Base‑related service. The available evidence confirms that the infrastructure is deliberately crafted to mimic a legitimate Base offering, leveraging a legitimate hosting provider to obtain a trusted certificate and hide behind a reputable CDN.

However, the exact content of the landing page has not been publicly disclosed, and no additional intelligence such as phishing kit hashes or campaign URLs has been released. Defenders should block the IP address 216.198.79.67 and the fully qualified domain name, add the domain to URL filtering and email gateway deny lists, and monitor for any DNS queries to the listed Vercel nameservers. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel feeds will help capture any future changes, such as additional detections or new hostings.