lucroai[.]net

Analysis of lucroai.net confirms it as a high-risk phishing domain impersonating the Base brand, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 172.67.194.241, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'Lucro AI - Plataforma Oficial | Trading IA 2026,' explicitly references Base in its branding, aligning with the confirmed scam type of brand impersonation.

Infrastructure checks reveal the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing flags it for social engineering, and 13 of 93 security vendors on VirusTotal detect it as malicious. The domain uses Cloudflare nameservers (aitana.ns.cloudflare.com and morgan.ns.cloudflare.com), a common tactic to obscure hosting origins. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification.

While the domain is currently offline, defenders should treat it as a confirmed threat vector for Base-related phishing campaigns. Historical DNS and WHOIS records should be preserved for forensic analysis, and security teams are advised to monitor for re-emergence under the same or similar infrastructure. No cryptocurrency addresses, payment gateways, or additional artifacts were provided in the available intelligence, limiting further attribution. The combination of brand impersonation, blocklist presence, and detection by multiple security vendors justifies its high-risk classification.