base-t[.]live

Analysis indicates that the domain base-t.live was registered on 29 April 2026 through URL Solutions, Inc. and is hosted on the IP address 194.67.193.230, which resolves to a location in Cyprus under MFI INVESTMENTS LIMITED. The domain uses Cloudflare nameservers (josh.ns.cloudflare.com, kallie.ns.cloudflare.com) and presents a valid TLS certificate issued by Google Trust Services / WE1, returning HTTP 200 with the page title “Temporary Auth”. Security telemetry shows the site is listed on three public blocklists (PhishDestroy, MetaMask, SEAL) and appears in one AlienVault OTX pulse. The Gridinsoft trust score is 0 / 100, reinforcing its malicious classification. VirusTotal reports that two of ninety‑one scanners have flagged the domain, confirming the presence of malicious activity. The campaign is categorized as a generic phishing operation employing brand impersonation, and its risk level is marked high. Current intelligence does not disclose the specific brand being spoofed nor the payload delivered, leaving the exact attack vector uncertain. Defenders should block DNS resolution for base-t.live, enforce TLS inspection to capture any credential exfiltration, and monitor outbound connections to the associated IP. Incident response teams should also correlate logs for any authentication attempts to “Temporary Auth” pages and consider adding the domain to internal deny lists while awaiting further forensic detail.