basedefi[.]support

PhishDestroy first observed basedefi.support on Apr 13, 2026. Stored content metadata identifies Coinbase as the apparent target. The captured page title is “Coinbase Support | Help Center & Customer Service”. Page analysis recorded additional brand references to Across and Coinbase wallet. Stored page analysis classifies the content as brand impersonation. Current evidence score: 99/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, DNS security resolvers, URLQuery, and URLScan. VirusTotal recorded 14 detections among 94 engines: ADMINUSLabs, BitDefender, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, OpenPhish, SOCRadar, Sophos on May 9, 2026 at 02:34 UTC. DNS security checks returned 1 blocking result across 12 tested policies: Brand Base; no observation timestamp was retained. URLQuery recorded 1 detection on Apr 13, 2026 at 16:53 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Coinbase and assigned phishing as its category on Jul 29, 2026 at 03:08 UTC. Non-positive and contextual checks: Gridinsoft assigned a trust score of 1/100; no observation timestamp was retained. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. Google Safe Browsing returned no flag on Apr 13, 2026 at 17:52 UTC. PhishStats returned no feed match on Apr 13, 2026 at 17:53 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:29 UTC; content was unavailable. The recorded creation date for the domain is Apr 13, 2026. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 216.198.79.1 on AS16509 (Amazon.com, Inc.). The IP and ASN identify shared Vercel edge infrastructure; the origin server is not established by this address. DOM analysis on Jul 29, 2026 at 04:01 UTC returned 73/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists Let's Encrypt as the certificate issuer; checked May 26, 2026 at 05:00 UTC.

The content indicators and 4 positive source findings support the current Coinbase-themed brand impersonation classification.