base-recover[.]cloud

The domain base-recover.cloud was registered through Tucows Domains Inc. on 22 November 2025. It is associated with a cryptocurrency‑related impersonation campaign targeting Coinbase, as indicated by the page title “Verify – Coinbase Wallet” and the explicit label “Impersonates: Coinbase”. The site resolves to the IPv4 address 103.138.189.99, which belongs to AS204800 owned by WHG Hosting Services Ltd and is geolocated in Singapore. Hosting is further reflected in the four authoritative name servers ns1.mysecurecloudhost.com, ns2.mysecurecloudhost.com, ns3.mysecurecloudhost.com, and ns, suggesting the use of a shared cloud‑hosting provider. The TLS certificate is issued by Let’s Encrypt (R12), providing a valid HTTPS connection but offering no assurance of legitimacy.

VirusTotal analysis shows that 14 of 95 scanning engines flag the domain, reinforcing the suspicion of malicious activity. Google Safe Browsing classifies the domain as social engineering, and it appears on a single security blocklist as well as being blocked by PhishDestroy. The MX record points to the domain itself with priority 0, a configuration often observed in phishing infrastructure. The current operational status is offline, indicating that the site has been taken down or otherwise rendered inaccessible. Defenders should treat base-recover.cloud as high‑risk.

The combination of brand impersonation, a verified SSL certificate, and multiple detections across independent providers suggests an active credential‑ harvesting or crypto‑scam operation. Monitoring should include continued DNS resolution checks for the IP 103.138.189.99 and the associated name servers, as the infrastructure may be repurposed for other campaigns. Email security gateways should block inbound messages that reference the domain or its MX record, and web filtering solutions should deny HTTP/HTTPS requests to the domain regardless of its offline status.