basepoker[.]com

This domain, basepoker.com, is under investigation for brand impersonation targeting OKX, a well-known cryptocurrency exchange. The site presented itself as an instant crypto poker platform supporting multiple cryptocurrencies, including USDT, SOL, ETH, and BTC, with no download required. Current status indicates the domain has been taken offline, though prior activity suggests malicious intent to deceive users into engaging with fraudulent financial services under the guise of a legitimate brand. Analysis of the domain reveals it was registered on February 21, 2026, through NameCheap, Inc., and resolved to the IP address 13.32.220.110. Infrastructure analysis indicates the use of Amazon Web Services, including CloudFront, S3, SES, and an SSL certificate issued by Amazon. Additional technologies detected include Sendgrid, Google Tag Manager, Google Analytics, and HTTP/3. Despite its suspicious nature, the domain was not flagged by any of the 95 vendors on VirusTotal at the time of assessment. However, it appeared on one security blocklist and was subsequently blocked by PhishDestroy, a known anti-phishing service. The risk posed by this domain stems from its sophisticated infrastructure and targeted impersonation of a trusted cryptocurrency platform. The absence of detections on VirusTotal does not mitigate the threat, as the domain's technical setup and branding align with tactics used in cryptocurrency scams, including potential crypto drainer schemes. Organizations and users are advised to treat this domain as high-risk and implement proactive measures. Recommended actions include blocking the domain and associated IP address at the network level, monitoring for related phishing campaigns, and educating users on recognizing brand impersonation tactics. Security teams should also investigate any historical traffic to this domain for potential compromise indicators.