establevaultrez-ai[.]net

This domain, establevaultrez-ai.net, is flagged as a high-risk brand impersonation threat targeting Base, a known cryptocurrency platform. Analysis indicates the domain was registered on January 25, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline. Infrastructure analysis reveals it resolved to IP 172.67.143.252, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic for malicious domains. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEON’s SEAL, and is classified as an investment scam.

Google Safe Browsing explicitly flags it for social engineering, while Gridinsoft assigns a trust score of 0/100. The page title, 'Estable Vaultrez - Plataforma Oficial | Trading IA 2026,' suggests an attempt to mimic an official trading platform, though no SSL certificate was detected. Sixteen of 93 security vendors on VirusTotal have flagged the domain, reinforcing its malicious classification.

Defenders should treat this domain as confirmed malicious, block all resolutions at the DNS level, and monitor for related infrastructure (e.g., Cloudflare nameservers kaiser.ns.cloudflare.com and zoe.ns.cloudflare.com) in logs. Given the domain’s offline status, further analysis may require historical WHOIS or passive DNS data to identify additional indicators of compromise. No evidence of a phishing kit or specific payload is available, but the combination of blocklist presence, brand impersonation, and social engineering flags warrants immediate containment action.