basekrn[.]sbs

Analysis of the domain basekrn.sbs shows a high‑risk brand‑impersonation campaign targeting the decentralized exchange aggregator 1inch. The site was created on September 03, 2025 through Dynadot LLC and is currently taken offline, but historical data indicates it was actively serving a crypto‑scam page whose HTML title was "CoinBase". Google Safe Browsing classifies the domain as social engineering, and PhishDestroy has confirmed the site as blocked. Technical scans reveal the domain resolves to the Cloudflare‑owned address 172.66.47.179, belonging to ASN 13335 in the United States.

No TLS certificate is presented, leaving the HTTP channel unencrypted. Reputation services assign extremely low trust scores: Gridinsoft 0/100, Scamadviser 1/100, and the domain appears on a single security blocklist. VirusTotal records 16 of 95 antivirus engines flagging the host, reinforcing the malicious assessment. Nameservers are achiel.ns.cloudflare.com and hazel.ns.cloudflare.com, both Cloudflare‑managed.

The combination of brand impersonation, a misleading page title, lack of encryption, and multiple vendor detections suggests a credential‑harvesting or fund‑diversion scheme aimed at 1inch users. Defenders should immediately block the domain at perimeter and DNS layers, update intrusion‑detection signatures with the observed IP and nameserver pair, and monitor for similar Cloudflare‑hosted assets created after September 2025 that reference 1inch or use the "CoinBase" title. Continuous re‑examination of the domain’s content, should it reactivate, is advised to capture any evolving phishing templates.