venicebase[.]com

Analysis of the DNS records shows venicebase.com resolves to the IP address 172.67.172.185, an address owned by Cloudflare, Inc. and geolocated to Canada. The domain is delegated to Cloudflare’s default nameservers ligia.ns.cloudflare.com and ryan.ns.cloudflare.com, a pattern often seen with rapidly provisioned malicious infrastructure. Registration information lists MAT BAO CORPORATION as the registrar, with the domain creation timestamp recorded as 07 May 2026, indicating a relatively recent deployment. The TLS certificate presented by the site is issued by Let’s Encrypt (subject identifier E8), confirming the use of a free, automated certificate rather than a bespoke or organizational certificate.

The sole page title retrieved from the site is FASTPANEL, a generic control‑panel label that does not disclose a targeted brand or service, and no further page content has been captured because the site is currently offline. VirusTotal scanning reported 9 positive detections out of 92 security scanners, providing independent confirmation of malicious intent. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, reinforcing the suspicion of abuse. AlienVault OTX references the domain in a single threat‑intel pulse, and the domain appears on three public blocklists while being actively blocked by PhishDestroy, MetaMask, and SEAL.

The combined evidence from DNS, certificate, detection vendors, blocklists, and threat‑intel feeds establishes venicebase.com as a confirmed phishing infrastructure. Uncertainty remains regarding the specific phishing lure, victim brand, or credential‑harvesting page design, as the page title alone offers no contextual clues. Defenders should block DNS resolution to 172.67.172.185 for this domain, add venicebase.com to URL filtering and email security policies, and monitor TLS inspection logs for attempts to negotiate the Let’s Encrypt certificate.