www-base[.]app

The domain www-base.app was observed as part of a crypto‑scam phishing campaign. It was registered through NiceNIC International Group Co., Limited on 18 December 2025. The authoritative name servers are ethan.ns.cloudflare.com and lily.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s network (AS13335, United States). DNS resolution returns the address 172.67.131.200, which is a Cloudflare‑provided IP. No TLS certificate is presented, and HTTP requests receive no response because the site has been taken offline.

The domain appears on a single public blocklist and is listed as blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a trust score of 1 out of 100, reflecting an extremely low confidence level. VirusTotal has processed the domain; 16 of 95 security vendors returned a malicious classification, reinforcing the suspicion of abuse. The combination of a recent registration, low trust score, lack of encryption, and multiple vendor detections aligns with the labeling of a crypto‑scam phishing operation.

However, the absence of a page title, content snapshot, or explicit victim brand limits the ability to describe the exact luring technique. Defenders should continue to block the domain at perimeter filters, update threat‑intel feeds with the observed indicators, and monitor for any resurgence of the domain or related subdomains. Additional monitoring of the associated IP address for reuse in other malicious campaigns is recommended, given the shared Cloudflare infrastructure. Until the domain is fully taken down, any inbound traffic to www-base.app should be denied.