promocionalesbbase[.]com

The domain promocionalesbbase.com was flagged on 2026-07-12 as a high‑risk brand‑impersonation operation targeting the financial brand “base”. The site’s page title, “Banco Base - Catálogo de Promocionales”, indicates an attempt to lure victims under the guise of a legitimate bank catalogue. Infrastructure analysis shows the domain was registered on 2024-09-30 through NameCheap, Inc. It resolves to IP address 192.185.12.91, which is advertised as belonging to AS31898, an Oracle Corporation network located in the United States. DNS is served by ns305.websitewelcome.com and ns306.websitewelcome.com. The web server reports Apache HTTP Server behind Cloudflare, and the site runs PHP with Bootstrap, jQuery and cdnjs assets. HTTPS is provided by a Let’s Encrypt R13 certificate, and an initial HTTP request returns a 302 redirect. Security telemetry indicates the domain appears on one known blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records nine detections out of ninety‑five scanned engines, confirming malicious intent. The campaign is associated with a cryptocurrency‑draining scam, as indicated by the listed scam type. Current public evidence does not include a full page scrape or sample payload, so the exact credential‑stealing mechanisms and any downstream malicious infrastructure remain unverified. The presence of standard web technologies suggests a generic phishing kit, but the specific methods used to harvest user data have not been disclosed. Defenders should add promocionalesbbase.com to outbound filtering and DNS block lists, monitor for connections to 192.185.12.91, and enforce TLS inspection to capture the redirected payload. Continuous re‑evaluation is advised, as the operator could modify the site content or shift hosting. Inclusion of the domain in threat‑intel feeds will aid broader community awareness.