baseapp22[.]xyz

Analysis of baseapp22.xyz, observed on July 19, 2026, indicates an active generic phishing infrastructure with a high risk rating. The domain resolves to the Cloudflare edge address 104.21.69.165, which is geolocated to California, United States, and is served behind Cloudflare's network. The site presents an HTTP 200 response and advertises a page title of "UNDER DEVELOPMENT," suggesting the landing page is currently minimal or placeholder content. The domain is registered through NameSilo, LLC, and utilizes Cloudflare nameservers lou.ns.cloudflare.com and ursula.ns.cloudflare.com. SSL termination is provided by Google Trust Services under the WE1 certificate, confirming encrypted transport. VirusTotal reports five detections out of ninety‑one scanners, and AlienVault OTX references the domain in two threat‑intel pulses. It appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. While the precise phishing lure or targeted brand is not disclosed in the available data, the presence of multiple detections and blocklist listings confirms malicious intent. Defenders should block the domain at network perimeters, update DNS filtering rules, and monitor for any related indicator of compromise associated with the 104.21.69.165 IP range.