app-shadow[.]github[.]io

This domain, app-shadow[.]github[.]io, is actively engaged in brand impersonation targeting Base, a cryptocurrency exchange platform. The threat type is classified as high-risk due to its deceptive infrastructure, which closely mimics the legitimate Base brand to facilitate fraudulent transactions or credential harvesting. As of the latest assessment, the domain remains operational and is actively serving content under the title 'Shadow Exchange™ | Home Official Site,' creating a false sense of legitimacy for unsuspecting users. Infrastructure analysis reveals several critical indicators of compromise. The domain is hosted on GitHub Pages and resolves to the IPv6 address 2606:50c0:8002::153, located within the United States under AS54113 (Fastly, Inc.). It employs a Let's Encrypt SSL certificate (R12), which, while providing encryption, does not validate the authenticity of the site. The domain has been flagged by 8 of 95 security vendors on VirusTotal, and it appears on one security blocklist, specifically PhishDestroy. These technical indicators, combined with the absence of verifiable registration details, underscore the domain's malicious intent. The current status of app-shadow[.]github[.]io remains active, posing an ongoing threat to users who may mistake it for the legitimate Base platform. Organizations and individuals are advised to implement immediate countermeasures, including blocking the domain at the network level and adding it to endpoint protection exclusion lists. Users should be educated on recognizing impersonation tactics, such as verifying SSL certificate issuers and scrutinizing domain names for subtle discrepancies. Additionally, monitoring for further indicators of compromise, such as associated IP addresses or subdomains, is recommended to mitigate potential risks.