accountbase[.]net

Analysis dated July 25 2026 flags accountbase.net as an active high‑risk crypto‑scam domain that masquerades as the “base” brand. The domain was registered on December 25 2025 through Tucows Domains Inc. and is serviced by the authoritative nameservers ns1.systemdns.com, ns2.systemdns.com and ns3.systemdns.com. DNS resolution returns the IPv4 address 103.169.142.0, which belongs to AS209242 Cloudflare London, LLC and is geolocated to Australia. The hosting provider is Cloudflare, as indicated by the presence of HSTS, HTTP/3 and Cloudflare‑specific headers. The site presents a valid SSL certificate issued by Google Trust Services under the WR1 profile, allowing HTTPS connections with a 200 HTTP response code. Reputation metrics are uniformly negative: the Gridinsoft trust score is 0 out of 100, and the domain appears on one public blocklist.

VirusTotal analysis shows seven of ninety‑three scanners flag the host, confirming malicious behavior. The phishing‑specific blocklist PhishDestroy also lists the domain. The page title returned from the web server is “ACCOUNT BASE｜Accounting & Property Services”, which aligns with the reported brand impersonation of “base”. No additional public intelligence such as OTX or Safe Browsing entries were observed. Uncertainty remains regarding the exact payload delivered to victims; the provided intelligence does not include a screenshot, code sample, or detailed description of the malicious content.

Consequently, the full scope of the crypto‑draining mechanisms cannot be confirmed at this time. Defenders should block DNS resolution for accountbase.net at the resolver level, add the address 103.169.142.0 to network‑level deny lists, and ensure that web proxies inspect TLS traffic to detect the Google‑issued certificate used by this site.