baseopencheckstatus[.]netlify[.]app

baseopencheckstatus.netlify.app is a tenant hostname on Netlify, not a separately registered domain. PhishDestroy first observed the hostname on Aug 12, 2026. The hostname explicitly references Base; stored content metadata identifies the same apparent target. The captured page title is “Base Airdrop — Check Eligibility”. Stored page analysis classifies the content as crypto drainer. Current evidence score: 80/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, MetaMask, ScamSniffer, SEAL, and Google Safe Browsing. VirusTotal recorded 9 detections among 91 engines: alphaMountain.ai, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, LevelBlue, Sophos on Aug 21, 2026 at 22:55 UTC. MetaMask, ScamSniffer, and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 23, 2026 at 10:20 UTC. Google Safe Browsing flagged the domain: Social Engineering on Aug 21, 2026 at 22:56 UTC. Non-positive and contextual checks: URLScan completed without a malicious verdict (score 0) on Aug 12, 2026 at 11:08 UTC.

The collector marked the hostname reachable on Aug 12, 2026 at 05:11 UTC, but did not retain the HTTP response code. Netlify is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 35.157.26.135 on AS16509 (AMAZON-02 - Amazon.com, Inc., US). The IP and ASN identify shared Netlify infrastructure, not the tenant operator. DOM analysis on Aug 12, 2026 at 06:22 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and Cloudflare Radar. The platform TLS certificate was issued by DigiCert Inc with validity through Mar 19, 2027; checked Aug 12, 2026 at 07:02 UTC.

The content indicators and 5 positive source findings support the current Base-themed crypto drainer classification.