conibaseapps[.]wixstudio[.]com

The domain conibaseapps.wixstudio.com has been identified as a high-risk brand impersonation threat targeting Base, a well-known cryptocurrency platform. Analysis confirms this domain was actively used to deceive users by mimicking legitimate Base services, likely for fraudulent purposes such as credential theft or crypto asset diversion. The domain is currently offline, though prior activity warrants continued monitoring due to its confirmed malicious intent. Infrastructure analysis reveals the domain was registered on April 15, 2026, through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118. Security assessments indicate significant detection rates, with 12 of 95 VirusTotal vendors flagging the domain as malicious. Additionally, the domain appears on three security blocklists and has been proactively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate was issued by Let’s Encrypt, a common tactic used to lend superficial legitimacy to fraudulent sites. The creation date, coupled with the rapid inclusion on blocklists, suggests a coordinated effort to exploit users before detection. Current status indicates the domain has been taken offline, though the infrastructure remains a potential risk for future abuse. Organizations and users are advised to treat any past or future interactions with this domain as compromised. Security teams should update blocklists to include the domain and associated IP address, while monitoring for related domains or subdomains that may emerge. End-users should verify the authenticity of any communication or service claiming affiliation with Base, particularly those directing to non-official domains. Proactive measures, such as browser-based phishing protections and real-time threat intelligence feeds, are recommended to mitigate similar threats.