my[.]basetrade[.]io

The domain my.basetrade.io has been identified in connection with brand impersonation targeting Base. The site presented a page titled My Account and maintained an elevated risk classification prior to being taken offline. The impersonation leverages visual and textual elements designed to replicate official Base interfaces. Infrastructure analysis reveals that the domain was registered on September 25, 2024 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IP address 104.21.86.22. The unique seed associated with this case is b9c84a.

This domain is flagged by 3 of 95 VirusTotal vendors. It appears on 1 security blocklist and carries a Gridinsoft trust score of 0/100. The combination of low trust indicators and detection by multiple security vendors points to malicious intent consistent with attempts to harvest credentials under the guise of a legitimate Base service portal. Technical indicators include the use of a privacy-oriented registrar and hosting on infrastructure commonly associated with transient malicious deployments. Risk assessment classifies the threat as elevated due to the direct targeting of a recognized brand in the cryptocurrency space.

The domain is currently offline following intervention by PhishDestroy. Organizations and individuals are advised to monitor for similar domain registrations that mimic Base branding. Access to the domain should be avoided entirely. Any credentials potentially submitted to the site require immediate rotation and monitoring for unauthorized activity. Security teams should incorporate the observed indicators into detection rules to prevent future exposure to comparable threats. Continued vigilance is recommended given the rapid creation and takedown cycle observed in such campaigns.