basvvk[.]sbs

Analysis of basvvk.sbs indicates a high‑risk brand‑impersonation operation targeting the decentralized exchange platform 1inch. The domain was registered on 19 October 2025 through Dynadot LLC and resolves to the Cloudflare address 104.20.28.74, which is announced by AS13335 in the United States. No TLS certificate is presented, and the site currently returns no HTTP response because it has been taken offline. The page title observed during the brief crawl was "CoinBase", a mismatch that suggests the operators may be attempting to lure users familiar with cryptocurrency services.

The domain is listed on one security blocklist and has been actively blocked by PhishDestroy. Google Safe Browsing classifies it as social engineering, and AlienVault OTX references the domain in three separate threat‑intel pulses. VirusTotal scans show 16 of 95 antivirus engines flag the host as malicious. Scamadviser assigns a trust score of 1 / 100, reinforcing the low credibility of the infrastructure.

Nameservers achiel.ns.cloudflare.com and hazel.ns.cloudflare.com confirm the use of Cloudflare DNS. The observable indicators collectively point to a crypto‑scam campaign that pretends to represent 1inch while possibly redirecting victims to a counterfeit "CoinBase" landing page. Defenders should immediately add 104.20.28.74 and the domain name to network‑level blocklists, monitor for re‑registration of the same second‑level domain or similar spelling variations, and enforce strict URL filtering for any pages containing the "CoinBase" title that are accessed from internal users. Continuous observation of Cloudflare‑associated IP ranges for new domains created after October 2025 that reference 1inch is recommended, as the threat actor may reuse the same hosting provider for future campaigns.