user[.]basehubpanel[.]com

Analysis of the domain user.basehubpanel.com shows several indicators that align with a high‑risk phishing operation. The domain was registered through INWX GmbH on October 02, 2025 and is served by Cloudflare name servers crystal.ns.cloudflare.com and roan.ns.cloudflare.com. DNS resolution points to the IP address 104.21.38.225, which is part of Cloudflare’s global edge network, a common hosting choice for malicious actors seeking rapid content delivery and obfuscation of origin. The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing organization considers it malicious.

VirusTotal scans have returned four positive detections out of ninety‑one security vendors, providing additional independent confirmation of suspicious activity. No public safe‑browsing verdicts or Google Safe Browsing entries are currently recorded for this domain, but the presence on a blocklist and the vendor detections elevate its risk profile. The registrar information, DNS configuration, and hosting environment are all consistent with infrastructure frequently leveraged in credential‑stealing campaigns.

Because the domain’s page title and SSL certificate details have not been disclosed, those vectors remain unverified, but the existing evidence is sufficient for defensive action. Recommendations for security teams include adding user.basehubpanel.com to network and endpoint block lists, configuring DNS filtering to drop queries for the domain, and monitoring outbound connections to the IP 104.21.38.225 for potential data exfiltration. Continuous re‑evaluation is advised, as threat actors may modify payloads or hosting arrangements without notice.