app[.]zoemux[.]com

Analysis of the domain app.zoemux.com reveals a high-risk phishing operation targeting users of the Base cryptocurrency platform. The domain was registered on June 4, 2026, through Fewmoretaps OU, operating under the name Trustname.com. It resolves to the IP address 172.67.159.182, which is hosted in the United States under AS13335, associated with Cloudflare. The page title, 'Zoemux: Most Popular Online Crypto Casino Based on Blockchain,' is a deceptive lure designed to impersonate the Base brand, despite the site presenting itself as an online casino. The domain is currently active, as indicated by a 200 HTTP status code, and is protected by an SSL certificate issued by Google Trust Services. The phishing kit identified is the Gambler Scam, which is typically used to harvest cryptocurrency credentials or wallet access. Security vendors have flagged this domain heavily, with 12 out of 95 detections on VirusTotal, and it appears on one security blocklist. The Gridinsoft trust score of 0 out of 100 further supports its malicious classification. The domain is blocked by PhishDestroy, but its continued operational status means it remains a threat to potential visitors. The connection between the phishing site and Base is evident, but the precise method of credential theft—whether through fake login forms or wallet connection prompts—is not fully detailed in the available intelligence. Defenders should prioritize blocking app.zoemux.com at the DNS and network levels, particularly for users associated with Base or cryptocurrency transactions. Users who may have interacted with the site should be warned to change passwords and revoke any permissions granted to the domain. Given the active status and low trust score, immediate action is recommended to prevent credential compromise.