base-login[.]us

base-login.us was registered on December 5, 2025 through Dynadot LLC. The domain is delegated to the Cloudflare name servers anita.ns.cloudflare.com and jerry.ns.cloudflare.com, indicating that the operator is using Cloudflare’s DNS and CDN services. The domain resolves to IP address 172.67.191.231, a Cloudflare edge node located in the United States. Network telemetry shows the site is served over HTTP/3 and presents a TLS certificate issued by Google Trust Services under the WE1 root. An HTTP 525 response is observed, meaning the origin server failed the SSL handshake, a pattern often seen in malicious front‑ends that rely on Cloudflare’s edge termination while the backend is misconfigured or deliberately inaccessible. Threat intelligence records flag base-login.us as a high‑risk brand‑impersonation campaign targeting the Base brand. The page title returned from the site is Halaman default, and the scam type is identified as a crypto scam. VirusTotal scans have marked the domain as malicious in 7 out of 95 scanners, and the domain appears on at least one public blocklist, where it has been listed by PhishDestroy. The combination of brand impersonation, a generic default page title, and the crypto‑scam label suggests the operator is attempting to lure Base users into a fraudulent transaction flow. Defenders should add base-login.us to network and endpoint blocklists, enforce DNS filtering, and consider sinkholing the associated IP range if feasible. Continuous monitoring of Cloudflare‑hosted domains that resolve to the same IP or share the same name‑server pair is recommended to detect future clones. Incident response teams handling Base‑related reports should treat any credential or wallet address request from this domain as malicious.