baselootym[.]pro

The domain baselootym.pro was registered on December 15, 2025 through NameSilo, LLC and is currently listed as offline. DNS resolution points to the IPv4 address 185.7.78.172, which belongs to AS43350 NForce Entertainment B.V. located in the Netherlands. The domain uses Cloudflare’s default nameservers kiki.ns.cloudflare.com and walt.ns.cloudflare.com. No SSL certificate is presented for the site, indicating that HTTPS was not configured at the time of takedown.

The only visible HTML element reported is the page title "Odette," but the page content has not been publicly disclosed, leaving the exact phishing vector and targeted brand undefined. VirusTotal recorded 16 detections out of 93 security vendors, confirming that multiple scanners identified malicious characteristics. Google Safe Browsing flags the domain for social engineering, and it appears on a single external security blocklist. Additional intelligence sources assign a Gridinsoft trust score of 0 out of 100 and note that the site is blocked by PhishDestroy.

The threat is classified as a crypto‑related scam, suggesting that victims may have been lured into sending cryptocurrency to fraudulent addresses. Defenders should immediately block the domain and the associated IP address at perimeter defenses, update local URL filtering policies, and monitor for any further activity originating from the NForce Entertainment hosting network. Because the site’s internal pages and phishing kit are not publicly available, continued reconnaissance of related subdomains and any repeat use of the same nameservers is recommended to pre‑empt future campaigns.