# PhishDestroy domain threat record: basedanchorai.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/basedanchorai.net/ Machine-readable companion: https://phishdestroy.io/domain/basedanchorai.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 02:12:54 UTC - Last availability or vendor check: 2026-10-25 02:24:17 UTC - Stored record updated: 2026-10-25 09:12:18 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: base ## Stored infrastructure - Observed IP address: 158.94.210.119 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-03 15:07:52 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a170dd-c5b4-702c-8bdd-29763fe4818a/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/basedanchorai.net - Certificate Transparency search: https://crt.sh/?q=%25.basedanchorai.net - Web Archive lookup: https://web.archive.org/web/*/https://basedanchorai.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added basedanchorai.net to its internal blocklist on 2026-10-25. The recorded page title advertises an AI platform for daily income. An HTTP 200 response was recorded on the same date, showing the site was reachable then. How the scam works The detections indicate the site could be used for typical phishing or financial‑fraud lures that promise AI‑generated earnings to collect personal or payment information. No credential‑stealing form or wallet‑draining code was observed on the page, so the exact mechanism remains unconfirmed. Evidence VirusTotal on 2026-10-25 reported 15 malicious and 2 suspicious detections out of 92 engines, with vendors such as BitDefender, Fortinet and Kaspersky labeling it phishing or malicious. Google Safe Browsing on 2026-10-25 returned a clean result. URLScan on 2026-10-25 gave an overall clean verdict but its engine score was 97 % malicious. Cloudflare Radar on 2026-10-25 flagged the domain as malicious under malware and phishing categories. OTX listed five pulses mentioning the domain. No external blocklists flagged it, while PhishDestroy’s internal list marks it as blocked. Infrastructure The domain was registered with Dynadot Inc on 2026-09-03, 52 days before first sighting. The recorded IP was 158.94.210.119, listed in the network record as belonging to Omegatech LTD in the Netherlands. TLS was provided by Let’s Encrypt, issued on 2026-10-24 and valid until 2027-01-22. Nameservers were jermaine.ns.cloudflare.com and ollie.ns.cloudflare.com, and open ports observed were 22, 80 and 443; DNSSEC was not enabled. What to do Do not enter credentials, payment details or personal data on the site. If any information was submitted, change associated passwords and monitor accounts for suspicious activity. Defenders should block traffic to basedanchorai.net, log any connections, and continue monitoring security feeds for updates. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a170dd-c5b4-702c-8bdd-29763fe4818a/ Cloudflare Radar report: https://radar.cloudflare.com/scan/e60ba8c5-26bf-4456-9a4d-1614e040f359 URLQuery report: https://urlquery.net/report/9afdba55-b737-41de-9bf3-141513248fe5 Stored capture screenshot: https://i.ibb.co/v6kY4gyB/117085cb6cff.png Cloudflare Radar screenshot (2026-10-25T02:22:22Z): https://screenshots.phishdestroy.io/cf/e60ba8c5-26bf-4456-9a4d-1614e040f359.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/9afdba55-b737-41de-9bf3-141513248fe5.png URLScan screenshot (2026-09-04T03:45:27Z): https://screenshots.phishdestroy.io/us/01a06a85-4a3e-755d-bea8-152465cd34fd.png URLScan capture report: https://urlscan.io/result/01a06a85-4a3e-755d-bea8-152465cd34fd/ URLScan screenshot (2026-09-04T09:45:29Z): https://screenshots.phishdestroy.io/us/01a06bce-fa7d-75df-ab29-b870c39f29c2.png URLScan capture report: https://urlscan.io/result/01a06bce-fa7d-75df-ab29-b870c39f29c2/ URLScan screenshot (2026-09-05T09:08:58Z): https://screenshots.phishdestroy.io/us/01a070d3-ea94-747f-8b12-ace1bfe07ee4.png URLScan capture report: https://urlscan.io/result/01a070d3-ea94-747f-8b12-ace1bfe07ee4/ URLScan screenshot (2026-10-25T02:18:34Z): https://screenshots.phishdestroy.io/us/01a170da-2500-775f-b9d3-63e7d5c58f01.png URLScan capture report: https://urlscan.io/result/01a170da-2500-775f-b9d3-63e7d5c58f01/ URLScan screenshot (2026-10-25T02:26:44Z): https://screenshots.phishdestroy.io/us/01a170e1-a176-7219-ba06-96e175b6dc7a.png URLScan capture report: https://urlscan.io/result/01a170e1-a176-7219-ba06-96e175b6dc7a/ VirusTotal report: https://www.virustotal.com/gui/domain/basedanchorai.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=basedanchorai.net Archived copy: https://web.archive.org/web/20261025021355/https://basedanchorai.net/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 03:34:51 UTC ## Stored page captures - Primary capture: https://i.ibb.co/v6kY4gyB/117085cb6cff.png Captured: 2026-10-25 02:24:17 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a170dd-c5b4-702c-8bdd-29763fe4818a.png Captured: 2026-10-25 02:24:17 UTC Source report: https://urlscan.io/result/01a170dd-c5b4-702c-8bdd-29763fe4818a/ - URLScan capture 2: https://urlscan.io/screenshots/01a06bce-fa7d-75df-ab29-b870c39f29c2.png Captured: 2026-10-25 02:12:54 UTC Source report: https://urlscan.io/result/01a170dd-c5b4-702c-8bdd-29763fe4818a/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e60ba8c5-26bf-4456-9a4d-1614e040f359.png Captured: 2026-10-25 02:22:22 UTC Source report: https://radar.cloudflare.com/scan/e60ba8c5-26bf-4456-9a4d-1614e040f359 SHA-256: bff6331a622b0b2d89160e12b0439586d35afb1938f0eed4d6480c05b66c59e8 - URLQuery: https://screenshots.phishdestroy.io/uq/9afdba55-b737-41de-9bf3-141513248fe5.png Source report: https://urlquery.net/report/9afdba55-b737-41de-9bf3-141513248fe5 SHA-256: 60859aa467b619fab096ccae9d1021b4c0f877dfde5984518c06ce14abe77d40 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06a85-4a3e-755d-bea8-152465cd34fd.png Captured: 2026-09-04 03:45:27 UTC Source report: https://urlscan.io/result/01a06a85-4a3e-755d-bea8-152465cd34fd/ SHA-256: 02fc6f946b83427ceaa8fc31ac0fbd4560b1fc7180188e1472974944083d3192 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06bce-fa7d-75df-ab29-b870c39f29c2.png Captured: 2026-09-04 09:45:29 UTC Source report: https://urlscan.io/result/01a06bce-fa7d-75df-ab29-b870c39f29c2/ SHA-256: 44c48cd8e9f3e99dde0681b0795bb3f47c6c87aeeea6cdcd63c25b19e3a48217 - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a070d3-ea94-747f-8b12-ace1bfe07ee4.png Captured: 2026-09-05 09:08:58 UTC Source report: https://urlscan.io/result/01a070d3-ea94-747f-8b12-ace1bfe07ee4/ SHA-256: a93fece0d5f457f13cb3e219ab6b82e62cc9776ec3c79af4e1489c7163ae45de - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a170da-2500-775f-b9d3-63e7d5c58f01.png Captured: 2026-10-25 02:18:34 UTC Source report: https://urlscan.io/result/01a170da-2500-775f-b9d3-63e7d5c58f01/ SHA-256: 1cb6f6fe2e03d1498213934222270cd845d2c13dbc4f5b7cf286533fb94bfd12 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a170e1-a176-7219-ba06-96e175b6dc7a.png Captured: 2026-10-25 02:26:44 UTC Source report: https://urlscan.io/result/01a170e1-a176-7219-ba06-96e175b6dc7a/ SHA-256: fe0492b161362eec1bfa9071f37a19943484d3a5c9ee33e2724c751b6d8d82f8 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T02:56:15Z", "uuid": "01a170dd-c5b4-702c-8bdd-29763fe4818a", "scanned_at": "2026-10-25T02:22:41Z", "final_url": "https://basedanchorai.net/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://basedanchorai.net/", "from": "http://basedanchorai.net/", "status": 307 } ], "ip": "158.94.210.119", "ips": [ "158.94.210.119" ], "asns": [ "202412" ], "countries": [ "NL" ], "doc_hash": "485b4a2702d6774e752a03246153e9307902018108930aa065b930164d431e0a", "script_hashes": [ "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce" ], "globals": [ "__dclq", "__dclOrig", "__dclFlush", "__smsCheckBeforeSubmit", "__isSmsEnabled", "__isSmsVerified", "intlTelInput" ], "cookies": [ "connect.sid" ], "tls": { "san": [ "*.basedanchorai.net", "basedanchorai.net" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "basedanchorai.net", "protocol": "TLS 1.3", "valid_to": "2027-01-22T09:43:03Z", "valid_from": "2026-10-24T09:43:04Z" }, "domain_age_days": 51, "apex_age_days": 51, "tls_age_days": 0, "tls_valid_days": 89, "requests": 7, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T02:23:36Z", "uuid": "e60ba8c5-26bf-4456-9a4d-1614e040f359", "scanned_at": "2026-10-25T02:22:22Z", "final_url": "https://basedanchorai.net/", "status": 200, "history": [ { "url": "https://basedanchorai.net/", "status": 200 } ], "dom_hash": "aca1b804c921dc43227bb83b026303fc235b60f57329ca2961013623cc8a3a87", "doc_hash": "67234d0147bc7c2eb0c2699ec660dc900947a449ac4ad4df474d7de04a3e5a7f", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "domain_risks": [ "Scam", "Security threats", "Malware", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "basedanchorai.net", "type": "A", "value": "158.94.210.119" } ], "dnssec_valid": false, "ip": "158.94.210.119", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-03T17:07:52Z", "updated": "2026-09-03T17:08:06Z", "expires": "2027-09-03T17:07:52Z", "nameservers": [ "jermaine.ns.cloudflare.com", "ollie.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T03:29:39Z", "analysis_at": "2026-10-24T19:53:08Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 15, "suspicious": 2, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "malware", "CyRadar": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Google": "financial_services", "Sophos": "spyware and malware", "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)" }, "registrar": "Dynadot Inc", "created": "2026-09-03T17:07:52Z", "expires": "2027-09-03T17:07:52Z", "updated": "2026-09-03T17:08:06Z", "first_seen": "2026-09-03T18:38:38Z", "dns": [ { "ttl": 300, "type": "A", "value": "158.94.210.119" }, { "ttl": 300, "type": "SOA", "rname": "hostmaster.basedanchorai.net", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "NS", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "NS", "value": "ns2.dyna-ns.net" } ], "dns_at": "2026-10-24T20:05:49Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "*.basedanchorai.net", "basedanchorai.net" ], "issuer": "Let's Encrypt / YE1", "serial": "5deda9025334d5fa2989849a39805da64be", "sha256": "b8eaedd9341cfe4e06f6570cc12d2d99b2d1247af411b9c1162b578b3a6c6ee7", "subject": "basedanchorai.net", "valid_to": "2027-01-22T09:43:03Z", "valid_from": "2026-10-24T09:43:04Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-09-03T17:07:52Z", "updated": "2026-09-03T17:08:06Z", "expires": "2027-09-03T17:07:52Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jermaine.ns.cloudflare.com", "ollie.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-03T17:07:52Z", "last changed": "2026-10-24T10:41:44Z", "registration": "2026-09-03T17:07:52Z", "registrar expiration": "2027-09-03T17:07:52Z", "last update of RDAP database": "2026-10-24T10:51:14Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T02:23:49Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "basedanchorai.net" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-25T02:13:55Z", "first": "2026-10-25T02:13:55Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 21444 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://basedanchorai.net/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 5 }, "social_tags": { "title": "Basedanchor AI — Plataforma de IA para tus ingresos diarios", "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1", "description": "Basedanchor AI es la plataforma de IA que traduce datos de mercado en recomendaciones claras, sin depósito mínimo ni conocimientos técnicos previos. Empieza con lo que tengas disponible.", "canonicalUrl": "https://basedanchorai.net/" }, "trackers": { "requests": 29, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 655, "tls": 100, "wait": 117, "connect": 72, "download": 141 }, "response_ms": 1085 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "carbon": { "bytes": 75006, "co2_grams": 0.0027, "cleaner_than": 28 }, "dns_server": { "ns": [ { "ip": "162.159.25.5", "host": "ns2.dyna-ns.net" }, { "ip": "162.159.26.92", "host": "ns1.dyna-ns.net" } ], "zone": "basedanchorai.net" }, "cookies": { "cookies": [ { "name": "cf-c", "http_only": true, "same_site": "Lax" }, { "name": "__cf_clicked" }, { "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "158.94.210.119", "asn": "202412", "org": "Omegatech LTD", "city": "Amsterdam", "country": "NL" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "basedanchorai.net" }, "dns": { "A": [ "158.94.210.119" ], "NS": [ "ns2.dyna-ns.net", "ns1.dyna-ns.net" ], "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.basedanchorai.net\", \"serial\": 2026102403, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "158.94.210.119", "family": 4 }, "redirects": { "chain": [ "https://basedanchorai.net" ] }, "linked_pages": { "internal_count": 9 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-03T17:07:52Z", "updated": "2026-10-24T10:33:30Z", "expires": "2027-09-03T17:07:52Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] }, "headers": { "headers": { "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin" } } } } ```