acpro[.]baseportal[.]io

Analysis of acpro.baseportal.io indicates a high‑risk crypto‑phishing operation that remains active as of 24 July 2026. The domain was registered through GoDaddy.com, LLC on 6 September 2024 and currently resolves to IP 76.76.21.22, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The site serves content over HTTPS using a Let’s Encrypt certificate (R13) and returns HTTP 200, confirming the presence of a live web server. Infrastructure observations show the domain is served via Cloudflare name servers (alfred.ns.cloudflare.com, bella.ns.cloudflare.com) and Vercel DNS records (ns1.vercel-dns-3.com, ns2.vercel), consistent with the detected stack of Node.js, React, Next.js, and Webpack. HSTS is enabled, and tracking scripts for Google Tag Manager and Facebook Pixel are present, suggesting attempts to gather analytics or user data.

Reputation signals are strongly negative: the Gridinsoft trust score is 0 / 100, and eight of ninety‑five VirusTotal scanners have flagged the domain, indicating malicious behavior. The domain is listed on at least one public blocklist and has been explicitly blocked by the PhishDestroy service. The page title “Baseportal” provides no obvious brand affiliation, and the only classified threat vector is a crypto scam, implying that victims may be lured into disclosing cryptocurrency wallet credentials or transferring funds. Defenders should treat acpro.baseportal.io as hostile.

Immediate actions include adding the domain and its IP address to outbound and inbound firewall deny lists, updating proxy and DNS filtering policies to block the domain, and ensuring that endpoint protection solutions incorporate the eight VirusTotal detections. Continuous monitoring of DNS queries for the associated Cloudflare and Vercel name servers is advised to detect any rapid re‑hosting attempts.