cardine-modevo[.]net

This domain, cardine-modevo.net, poses a high-risk brand impersonation threat specifically targeting users of the Base blockchain platform. Analysis of the page title, "Cardine Modevo - Piattaforma Ufficiale Italia | Trading IA 2026," indicates an attempt to deceive Italian-speaking users by mimicking an official trading platform associated with Base. The domain is designed to exploit trust in the Base brand, potentially leading to financial fraud, unauthorized transactions, or the deployment of crypto-draining malware. The inclusion of terms like "Trading IA" (AI Trading) and a localized Italian interface suggests a targeted campaign aimed at users seeking investment opportunities, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered on February 03, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), which is commonly used to obfuscate the true origin of malicious infrastructure. Security vendors have flagged the domain on VirusTotal, with 16 out of 95 engines detecting it as malicious. Additionally, the domain appears on three security blocklists and is explicitly flagged for phishing by Google Safe Browsing. Notably, the domain lacks an SSL certificate, further reducing its legitimacy and increasing the risk of man-in-the-middle attacks or data interception. Users who have visited cardine-modevo.net should take immediate action to mitigate potential risks. If any credentials, wallet addresses, or personal information were entered on the site, affected users should assume compromise and revoke access to any linked accounts or wallets. It is critical to scan the device used to access the domain for malware, particularly crypto-draining scripts or keyloggers. Users should also monitor transaction histories for unauthorized activity and report the domain to relevant security teams or abuse contacts. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts, as threat actors often re-deploy infrastructure under new domains. Verification of official Base communication channels is strongly recommended to avoid further exposure.