authel[.]lostgumball[.]com

Analysis of authel.lostgumball.com indicates that the domain is actively used for a crypto‑scam impersonating the brand “base”. The domain resolves to 82.153.68.133, an address owned by AS13649 Flexential Colorado Corp. in the United States. Registration records show the domain was created on 15 May 2004 and is registered through NameCheap, Inc. The authoritative name servers are ns1‑ns4.afraid.org, a set of free DNS services often leveraged by malicious operators. HTTP probing returned a 200 status code and the page title reported by scanners is “Domain Default page”, suggesting the site does not serve a bespoke landing page. The TLS certificate presented is issued to “PhishDestroy / botadmin.destroy.tools”, a known indicator of phishing infrastructure.

Reputation services give extremely low scores: Gridinsoft rates the domain 0 / 100, Scamadviser 1 / 100, and the domain appears on one security blocklist. VirusTotal scans recorded 15 detections out of 95 vendors, confirming that multiple anti‑malware products flag the host as malicious. The domain has been taken offline, and PhishDestroy reports it as blocked. Despite the offline status, the infrastructure components (IP, registrar, DNS, certificate) remain unchanged and could be re‑activated.

Defenders should continue to block the IP 82.153.68.133, add the domain to local deny lists, and monitor the associated name servers for any future re‑use. Network intrusion detection signatures that match the TLS fingerprint or the observed HTTP response can be deployed. Because the domain impersonates “base”, any credential or payment requests associated with that brand should be treated as suspicious. Ongoing intelligence collection is advised to detect possible re‑registration or related sub‑domains that reuse the same hosting environment.