5base[.]cfd

This domain, 5base.cfd, is actively impersonating the Base cryptocurrency platform to deceive users into disclosing wallet credentials or transferring funds to attacker-controlled addresses. The site mimics legitimate Base interfaces, including login portals and transaction prompts, to exploit trust in the brand. Users who interact with this domain risk immediate financial loss through unauthorized access to their crypto wallets or exposure of sensitive recovery phrases. Analysis indicates the domain was registered on May 27, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious infrastructure. It is flagged by 4 out of 95 security vendors on VirusTotal, including specialized crypto threat detection systems. The domain resolves to Cloudflare IP 188.114.97.3 (AS13335) and presents a Let's Encrypt SSL certificate (serial E8), a common tactic to appear legitimate. The page title 'Just a moment...' suggests the use of Cloudflare protection to obscure malicious content from automated scanners. If a user has visited 5base.cfd or entered any information, they should immediately disconnect the device from the internet and cease all crypto-related activity. All credentials or recovery phrases entered on the site must be considered compromised. Users should transfer remaining assets to a new, secure wallet using a different device and monitor transaction history for unauthorized activity. The device used to access the site should be scanned for malware, and all saved passwords or browser data should be cleared. Reporting the incident to the legitimate Base platform and relevant cybersecurity authorities is recommended to aid in tracking the threat.