Domain
base.app
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of base.app
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
104.18.42.167, 172.64.145.89
AAAA
2606:4700:4405::6812:2aa7, 2606:4700:440a::6812:2aa7, 2a06:98c1:3104::ac40:9159, 2a06:98c1:310b::ac40:9159
MX
—
NS
moura.ns.cloudflare.com, ryleigh.ns.cloudflare.com
TXT
v=spf1 -all
CNAME
—
CAA
0 iodef "mailto:security@coinbase.com"
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.
| Subdomain | Resolves to | Last seen |
|---|---|---|
| base.app | 2026-07-25 13:06:24.376 | |
| join.base.app | 2026-07-15 12:40:44.777 | |
| go.base.app | 1970-01-01 00:00:00.000 | |
| sngmi.base.app | 1970-01-01 00:00:00.000 |
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: www.rockbase.app
Issuer: WR3
SANs: www.rockbase.app
Subject: jkbase.app
Issuer: YE2
SANs: *.jkbase.app, jkbase.app
Subject: *.staging.turbobase.app
Issuer: YE1
SANs: *.staging.turbobase.app
Subject: *.soundbase.app
Issuer: YE1
SANs: *.soundbase.app, soundbase.app
Subject: support.gatewaybase.app
Issuer: YE2
SANs: support.gatewaybase.app
Subject: *.us-central1.firebasedatabase.app
Issuer: WR1
SANs: *.firebaseio.com, *.us-central1.firebasedatabase.app
Subject: *.us-central1.firebasedatabase.app
Issuer: WR1
SANs: *.firebaseio.com, *.us-central1.firebasedatabase.app
Subject: my.dishbase.app
Issuer: my.dishbase.app
SANs: my.dishbase.app
Subject: multibase.app
Issuer: YR1
SANs: multibase.app
Subject: drivebase.app
Issuer: FujiSSL SHA2 Domain Secure Site CA
SANs: drivebase.app
Subject: api.useafribase.app
Issuer: YE1
SANs: api.useafribase.app
Subject: metabase.app.dryviq.io
Issuer: R12
SANs: metabase.app.dryviq.io
Subject: www-fomonbase.app.Ford.com
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: www-fomonbase.app.Ford.com, www.fomonbase.ford.com
Subject: dev.base.app-kantsu.com
Issuer: R12
SANs: dev.base.app-kantsu.com
Subject: *.nbase.app
Issuer: NAVER Secure Certification Authority 2
SANs: *.nbase.app
Subject: *.asia-southeast1.firebasedatabase.app
Issuer: WR1
SANs: *.asia-southeast1.firebasedatabase.app
Subject: neobase.app
Issuer: R13
SANs: neobase.app
Subject: metabase.apphub.hellostake.com
Issuer: WR3
SANs: metabase.apphub.hellostake.com
Subject: beta.daobase.app
Issuer: Amazon RSA 2048 M01
SANs: beta.daobase.app
Subject: knowbase.app
Issuer: R13
SANs: knowbase.app, www.knowbase.app
Subject: ai.sellerbase.app
Issuer: E8
SANs: ai.sellerbase.app
Subject: *.us-central1.firebasedatabase.app
Issuer: WR1
SANs: *.firebaseio.com, *.us-central1.firebasedatabase.app
Subject: *.soundbase.app
Issuer: E8
SANs: *.soundbase.app, soundbase.app
Subject: beta.daobase.app
Issuer: Amazon RSA 2048 M01
SANs: beta.daobase.app
Subject: *.us-central1.firebasedatabase.app
Issuer: WR1
SANs: *.firebaseio.com, *.us-central1.firebasedatabase.app
Subject: ridebase.app
Issuer: ZeroSSL ECC DV SSL CA 2
SANs: *.ridebase.app, ridebase.app
Subject: cofiaykvjbqaflfhdwob.geobase.app
Issuer: E8
SANs: cofiaykvjbqaflfhdwob.geobase.app
Subject: www-fomonbase.app.Ford.com
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: www-fomonbase.app.Ford.com, www.fomonbase.ford.com
Subject: *.europe-west1.firebasedatabase.app
Issuer: WR1
SANs: *.europe-west1.firebasedatabase.app
Subject: grafana.geobase.app
Issuer: R13
SANs: grafana.geobase.app
IPs Citing This Domain
Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.
38.180.27.42:443
href · ×4
72.56.6.142:443
href · ×2
165.154.254.245:80
href · ×1
64.225.63.203:5000
href · ×1
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-IP leaks detected (yet)
Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.
CT-Log Evidence
Certificates from public Certificate Transparency logs whose subject or SAN names this domain — including historic certs we never observed live.
719c993abf826a60…
google · argon2026h2
Subject: *.coinbase.com
Issuer: Amazon RSA 2048 M04
SANs: *.coinbase.com, *.pay.coinbase.com, *.base.app, cbam.coinbase.com, coinbase.com, *.cdp.coinbase.com, *.institutional.coinbase.com, *.exchange.coinbase.com, *.coinbase-corp.com, base.dev, *.international.coinbase.com, *.prime.coinbase.com, *.wallet.coinbase.com, walletlink.org, *.walletlink.org, *.developer.coinbase.com, base.app, *.base.dev, *.verifiedpools.com, *.consumer.coinbase.com, *.cloud.coinbase.com, *.stagecloud.net, verifiedpools.com, *.commerce.coinbase.com
Valid: 2025-10-14 00:00:00 → 2026-11-12 23:59:59
719c993abf826a60…
cloudflare · nimbus2026
Subject: *.coinbase.com
Issuer: Amazon RSA 2048 M04
SANs: *.coinbase.com, *.pay.coinbase.com, *.base.app, cbam.coinbase.com, coinbase.com, *.cdp.coinbase.com, *.institutional.coinbase.com, *.exchange.coinbase.com, *.coinbase-corp.com, base.dev, *.international.coinbase.com, *.prime.coinbase.com, *.wallet.coinbase.com, walletlink.org, *.walletlink.org, *.developer.coinbase.com, base.app, *.base.dev, *.verifiedpools.com, *.consumer.coinbase.com, *.cloud.coinbase.com, *.stagecloud.net, verifiedpools.com, *.commerce.coinbase.com
Valid: 2025-10-14 00:00:00 → 2026-11-12 23:59:59
911678e3a65ab219…
google · argon2026h2
Subject: *.coinbase.com
Issuer: Amazon RSA 2048 M04
SANs: *.coinbase.com, *.pay.coinbase.com, cbam.coinbase.com, coinbase.com, *.base.app, *.cdp.coinbase.com, *.institutional.coinbase.com, *.exchange.coinbase.com, *.coinbase-corp.com, base.dev, *.international.coinbase.com, *.prime.coinbase.com, *.wallet.coinbase.com, walletlink.org, *.walletlink.org, base.app, *.developer.coinbase.com, *.base.dev, *.verifiedpools.com, *.consumer.coinbase.com, *.cloud.coinbase.com, verifiedpools.com, *.commerce.coinbase.com
Valid: 2025-09-19 00:00:00 → 2026-10-18 23:59:59
5da8805da2a4816e…
google · argon2026h2
Subject: *.coinbase.com
Issuer: Amazon RSA 2048 M01
SANs: *.coinbase.com, *.pay.coinbase.com, cbam.coinbase.com, coinbase.com, *.base.app, *.cdp.coinbase.com, *.institutional.coinbase.com, *.exchange.coinbase.com, base.dev, *.international.coinbase.com, *.prime.coinbase.com, walletlink.org, *.wallet.coinbase.com, *.walletlink.org, base.app, *.developer.coinbase.com, *.verifiedpools.com, *.base.dev, *.consumer.coinbase.com, *.cloud.coinbase.com, verifiedpools.com, *.commerce.coinbase.com
Valid: 2025-09-12 00:00:00 → 2026-10-11 23:59:59
fe67e2ae370db403…
google · argon2026h2
Subject: *.coinbase.com
Issuer: Amazon RSA 2048 M02
SANs: *.pay.coinbase.com, *.base.app, coinbase.com, *.cdp.coinbase.com, *.institutional.coinbase.com, *.exchange.coinbase.com, *.international.coinbase.com, base.dev, *.prime.coinbase.com, *.wallet.coinbase.com, walletlink.org, *.walletlink.org, base.app, *.developer.coinbase.com, *.verifiedpools.com, *.base.dev, *.consumer.coinbase.com, *.cloud.coinbase.com, verifiedpools.com, *.commerce.coinbase.com, *.coinbase.com
Valid: 2025-08-11 00:00:00 → 2026-09-09 23:59:59
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| TXT | v=spf1 -all | 2026-05-27 13:52:01.779 | 2026-07-25 13:06:24.376 |
| AAAA | 2a06:98c1:310b::ac40:9159 | 2026-05-27 13:52:01.779 | 2026-06-17 18:11:39.930 |
| NS | moura.ns.cloudflare.com | 2026-05-27 13:52:01.779 | 2026-07-25 13:06:24.376 |
| A | 104.18.42.167 | 2026-05-27 13:52:01.779 | 2026-07-25 13:06:24.376 |
| A | 172.64.145.89 | 2026-05-27 13:52:01.779 | 2026-07-25 13:06:24.376 |
| NS | ryleigh.ns.cloudflare.com | 2026-05-27 13:52:01.779 | 2026-07-25 13:06:24.376 |
| AAAA | 2606:4700:440a::6812:2aa7 | 2026-05-27 13:52:01.779 | 2026-06-17 18:11:39.930 |
| CAA | 0 iodef "mailto:security@coinbase.com" | 2026-05-27 13:52:01.779 | 2026-07-25 13:06:24.376 |
| AAAA | 2a06:98c1:3104::ac40:9159 | 2026-06-25 15:58:37.764 | 2026-07-25 13:06:24.376 |
| AAAA | 2606:4700:4405::6812:2aa7 | 2026-06-25 15:58:37.764 | 2026-07-25 13:06:24.376 |