base-upgrades[.]net

Analysis of base-upgrades.net shows a newly registered domain (created 21 February 2026) that was observed serving a page titled “Jurivoron | Expert Legal Counsel & Representation”. The page title indicates a purported legal‑service offering, but the domain is listed as a brand‑impersonation phishing site. Infrastructure traces reveal the domain resolves to the IPv6 address 2606:4700:3037::ac43:8080, which belongs to AS13335 operated by Cloudflare, Inc., confirming the use of a reputable CDN for hosting. The site presented a valid SSL certificate (identified as WE1), meaning TLS connections would be accepted by browsers.

Security telemetry shows the domain appears on one blocklist and is specifically blocked by PhishDestroy. VirusTotal scans returned 14 detections out of 93 vendors, reinforcing the malicious classification. The current HTTP status is offline, indicating the site is no longer serving content, but the historical evidence is sufficient for defensive action.

No additional data such as Safe Browsing, Open Threat Exchange, or registrar details were provided, leaving the exact phishing kit and victim targeting unknown. Defenders should immediately add base-upgrades.net to DNS and proxy blocklists, monitor for repeated queries to the associated Cloudflare IP range, and consider correlating any login credential submissions to this domain with other known brand‑impersonation campaigns. Ongoing observation of Cloudflare‑hosted domains created after February 2026 is advised, as the infrastructure choice suggests a low‑cost, high‑availability approach commonly used by phishing operators.