user[.]baseroomhub[.]com

The domain user.baseroomhub.com has been identified as a brand impersonation threat targeting Base, currently taken offline. This domain was created on January 12, 2026, and resolved to IP address 172.67.180.104. The page title 'Base Room Hub' was used to deceive users into believing it was a legitimate Base service. The domain appears on 3 security blocklists and was registered through Realtime Register B.V., with an SSL certificate issued by Google Trust Services / WE1.

PhishDestroy's analysis reveals that this domain exhibits classic indicators of brand impersonation, leveraging a convincing name and page title to trick users. VirusTotal data shows that only 1 out of 95 security vendors flagged the domain, indicating low initial detection but significant risk due to the targeted brand. The domain's recent creation date and use of a reputable SSL provider are common tactics to evade suspicion. The resolution to Cloudflare's IP range suggests use of a content delivery network to mask the true hosting origin.

Given that the domain is now offline, the immediate threat is mitigated, but users should remain vigilant for similar domains. PhishDestroy recommends that organizations monitor for lookalike domains and implement DMARC policies to prevent email spoofing. End users are advised to verify URLs carefully and report any suspicious communications claiming to be from Base. Regular scanning of network traffic for connections to this IP or related domains is also advised to prevent future compromises.