moh-nna-base[.]pages[.]dev

This domain, moh-nna-base.pages.dev, is currently under investigation for brand impersonation targeting Base, a cryptocurrency platform. The domain remains active and has not yet been widely flagged by security vendors, though initial indicators suggest potential malicious intent through unauthorized use of the Base brand identity. Analysis is ongoing to determine whether this constitutes a crypto drainer, credential theft, or other fraudulent activity. Infrastructure analysis reveals the domain was registered on April 08, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.146, located in the United States under AS13335 (Cloudflare, Inc.). As of the latest scan, the domain has not been flagged by any of the 95 vendors on VirusTotal, though it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains. The page title, t768-p790-blue.prd.cwp2.sg | Unlighthouse, does not align with typical Base branding and may indicate an attempt to obfuscate the site's true purpose or evade detection. Current findings suggest this domain poses a potential risk to users of the Base platform, particularly if it is used to distribute fraudulent applications, harvest credentials, or facilitate unauthorized transactions. Organizations and individuals are advised to block access to moh-nna-base.pages.dev at the network level and monitor for any associated indicators of compromise. Users should verify the authenticity of any communication or websites claiming affiliation with Base by cross-referencing official channels. Further analysis is required to determine the full scope of this threat, and security teams are encouraged to submit samples or additional telemetry to threat intelligence platforms for broader visibility.