login[.]gainbase[.]co

The domain login.gainbase.co was registered on March 12, 2026 through Porkbun LLC. It is being used to impersonate the financial‑technology brand Base, as indicated by the brand target field and the observed page title that redirects to a generic “porkbun.com | domain for sale” landing page. The registration date and the presence of a brand name in the subdomain suggest a deliberate attempt to lure Base customers to a credential‑harvesting site. Technical analysis shows the domain resolves to the IPv4 address 52.33.207.7, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. The server presents a Let’s Encrypt certificate (R13) and responds with an HTTP 301 redirect to the parking page hosted by Porkbun. The authoritative nameservers are CURITIBA.NS.PORKBUN.COM, FORTALEZA.NS.PORKBUN.COM, and MACEIO.NS.PORKBUN.COM, confirming the registrar’s infrastructure. The site is currently listed on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans have a 7 out of 95 vendor detection rate, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. Despite the redirection to a parking page, the domain remains active and could be repurposed to serve a credential‑stealing payload at any time. Defenders should add login.gainbase.co to network‑level blocklists and monitor DNS queries for this FQDN across their environments. Email gateways should inspect inbound messages for references to “login.gainbase.co” and apply brand‑specific impersonation rules for Base. Continuous re‑assessment is advised, as the underlying infrastructure—hosted on a cloud provider—could be reconfigured to serve malicious content without further notice.