sl-web[.]fr

The domain sl-web.fr was identified as a brand impersonation threat, specifically targeting the brand Base. This domain was created on December 06, 2025, and registered through IONOS SE. The page title was observed as "SL Web," which aligns with the impersonated brand. No specific crypto drainer kit was detected, but the site was designed to deceive users into believing they were interacting with Base's legitimate online services.

Technical indicators reveal that sl-web.fr resolves to IP address 75.2.60.5 and uses an SSL certificate issued by Let's Encrypt with thumbprint E7. VirusTotal analysis shows that 14 out of 95 security vendors flagged this domain as malicious. The domain appears on 2 security blocklists and was found in 1 threat intelligence pulse on AlienVault OTX. It is not listed on Google Safe Browsing based on available data, but its presence on other blocklists indicates active threat intelligence sharing.

As of the latest check, sl-web.fr has been taken offline. The response actions included flagging the domain to relevant authorities and updating blocklists. However, the risk remains that similar domains may be registered by the same threat actor. PhishDestroy recommends monitoring for related domains and educating users to verify URLs before entering credentials. Users who may have interacted with this site should change their passwords and enable multi-factor authentication on their Base accounts immediately.