ftp[.]vertex-base[.]pro

On 24 July 2026, analysis of the domain ftp.vertex-base.pro identified a high‑risk brand‑impersonation infrastructure targeting the brand “base”. The domain was registered through NameCheap, Inc. on 31 October 2025 and currently resolves to the IPv4 address 198.54.125.89, which is allocated to AS22612 (Namecheap, Inc.) and geolocated to the United States. Authoritative name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com are in use, and the domain’s MX configuration includes mx1-hosting.jellyfish.systems (priority 5) and a secondary host (priority 10) as indicated in the partial record. The web service returns HTTP 200 and presents the generic title “Default Web Site Page”. An SSL certificate issued by Sectigo Limited, signed by the Sectigo RSA Domain Validation Secure Server CA, is active, confirming the use of a valid TLS layer.

Reputation services flag the domain as malicious. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that eight of ninety‑five scanning engines have produced a detection. The domain appears on one public blocklist and is listed as blocked by the PhishDestroy service. The observed scam type is classified as a crypto‑related scam, although the exact payload or phishing landing page has not been captured in the available data. The evidence confirms that the domain is actively hosted and reachable, and that multiple security vendors have identified it as malicious.

However, the content of the hosted page beyond the default title has not been publicly disclosed, and the incomplete MX record prevents full verification of email‑based abuse. Defenders should add the IPv4 address 198.54.125.89 and the domain ftp.vertex-base.pro to blocklists at network perimeter and DNS filtering layers. Monitoring of TLS certificates issued by Sectigo for this domain is recommended to detect any future re‑issuance.