# PhishDestroy domain threat record: baseinvexus.pro Content language: English Canonical HTML report: https://phishdestroy.io/domain/baseinvexus.pro/ Machine-readable companion: https://phishdestroy.io/domain/baseinvexus.pro/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 22:52:24 UTC - Last availability or vendor check: 2026-10-22 22:52:24 UTC - Stored record updated: 2026-10-23 00:00:35 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Base ## Stored infrastructure - Observed IP address: 185.62.57.28 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-06-07 04:57:37 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a165ce-efa0-77b8-b76b-0dc5b6b8206c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/baseinvexus.pro - Certificate Transparency search: https://crt.sh/?q=%25.baseinvexus.pro - Web Archive lookup: https://web.archive.org/web/*/https://baseinvexus.pro/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed baseinvexus.pro as a suspicious domain after intake on 2026-10-22, citing 14 malicious detections on VirusTotal. The domain was first seen by PhishDestroy on 2026-10-23. The recorded page title is "base invexus | AI Trading Platform | Official Website". An HTTP 200 response was recorded on 2026-10-23. How the scam works When many security vendors flag a site as phishing or malware, it is often used to impersonate legitimate services and lure users into revealing credentials or installing unwanted software. No specific malicious functionality or credential‑stealing form was observed on the captured page, so the exact mechanism remains unconfirmed. Evidence VirusTotal reported 14 malicious and 3 suspicious detections from 92 engines on 2026-10-23, with vendors such as BitDefender, Fortinet and Kaspersky labeling the domain as phishing or malicious. Google Safe Browsing checked on 2026-10-23 did not flag the site. urlscan.io recorded on 2026-10-23 showed engine verdicts marking the URL as malicious with a score of 99, while its overall verdict was neutral. Cloudflare Radar on 2026-10-23 gave a malicious verdict and categorized the domain under malware. OTX listed four pulses referencing the domain as of 2026-10-23. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed no entries on 2026-10-22. Infrastructure The recorded IP was 185.62.57.28, hosted by Snel.com B.V. in the Netherlands, and the domain used Cloudflare nameservers. The TLS certificate, issued by ZeroSSL ECC DV SSL CA 2, was valid from 2026-09-19 to 2026-12-18. The domain was registered with Dynadot Inc on 2026-06-07, 138 days before first observation. What to do Visitors should avoid entering any credentials, personal data or downloading files from the site and should change passwords if they suspect they may have been submitted. Organizations should add baseinvexus.pro to web filtering and monitor DNS logs for queries to 185.62.57.28. Security teams can reference the VirusTotal and Cloudflare Radar detections when justifying blocklist entries. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a165ce-efa0-77b8-b76b-0dc5b6b8206c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/998955eb-1a8b-412c-9567-ce435d68e2fa Stored capture screenshot: https://urlscan.io/screenshots/01a165ce-efa0-77b8-b76b-0dc5b6b8206c.png Cloudflare Radar screenshot (2026-10-22T22:52:52Z): https://screenshots.phishdestroy.io/cf/998955eb-1a8b-412c-9567-ce435d68e2fa.png VirusTotal report: https://www.virustotal.com/gui/domain/baseinvexus.pro Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=baseinvexus.pro Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 22:53:54 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a165ce-efa0-77b8-b76b-0dc5b6b8206c.png Captured: 2026-10-22 22:52:24 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a165ce-efa0-77b8-b76b-0dc5b6b8206c.png Captured: 2026-10-22 22:52:24 UTC Source report: https://urlscan.io/result/01a165ce-efa0-77b8-b76b-0dc5b6b8206c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/998955eb-1a8b-412c-9567-ce435d68e2fa.png Captured: 2026-10-22 22:52:52 UTC Source report: https://radar.cloudflare.com/scan/998955eb-1a8b-412c-9567-ce435d68e2fa SHA-256: 63c44cb30e047f9091a51e6babfe883b2d76e67e1c065165631cdb08d5d12817 - URLQuery: https://screenshots.phishdestroy.io/uq/b38fc631-97db-4758-91be-4b11a2fb0fc2.png Source report: https://urlquery.net/report/b38fc631-97db-4758-91be-4b11a2fb0fc2 SHA-256: 9c7560e4c3719b95d4b9c4b7712a9f861fdfebef9e910ac0fd68fd93556fc9bb ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T22:53:09Z", "uuid": "01a165ce-efa0-77b8-b76b-0dc5b6b8206c", "scanned_at": "2026-10-22T22:50:37Z", "final_url": "https://baseinvexus.pro/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://baseinvexus.pro/", "from": "http://baseinvexus.pro/", "status": 307 } ], "ip": "185.62.57.28", "ptr": "static-28-57-62-185.hosted-by-snel.com", "domains": [ "cdn.jsdelivr.net", "challenges.cloudflare.com", "cdnjs.cloudflare.com", "fonts.gstatic.com", "www.cloudflare.com", "fonts.googleapis.com" ], "ips": [ "142.251.110.94", "104.18.94.41", "104.16.123.96", "151.101.65.229", "104.17.25.14", "192.178.183.95", "185.62.57.28" ], "asns": [ "15169", "13335", "54113", "62370" ], "countries": [ "US", "NL" ], "doc_hash": "8f9539c1499dd74e33543e82e2e0b6fe302c0dbc05c8a77a9738b22810e564c4", "script_hashes": [ "a888dc44144c6fc6309869266965da71105c331b72f59e37c73706f18140dde7" ], "globals": [ "toggleTermsPopup", "intlTelInput", "__TS_SITEKEY", "__tsGet", "__tsReset", "__tsNeedsClick", "__tsShow", "__lgBS", "ClientJS", "__visitorCountry", "turnstile" ], "storage_keys": [ "t_cfp" ], "tls": { "san": [ "baseinvexus.pro" ], "cipher": "AES_128_GCM", "issuer": "ZeroSSL ECC DV SSL CA 2", "subject": "baseinvexus.pro", "protocol": "TLS 1.3", "valid_to": "2026-12-18T23:59:59Z", "valid_from": "2026-09-19T00:00:00Z" }, "domain_age_days": 136, "apex_age_days": 136, "tls_age_days": 33, "tls_valid_days": 90, "requests": 23, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T22:53:17Z", "uuid": "998955eb-1a8b-412c-9567-ce435d68e2fa", "scanned_at": "2026-10-22T22:52:52Z", "final_url": "https://baseinvexus.pro/", "status": 200, "history": [ { "url": "https://baseinvexus.pro/", "status": 200 } ], "dom_hash": "6c64a9453197dfe2e38da44df975c469da686f34841c7dda23a6cbee9b55ad7f", "doc_hash": "8f9539c1499dd74e33543e82e2e0b6fe302c0dbc05c8a77a9738b22810e564c4", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "baseinvexus.pro", "type": "A", "value": "185.62.57.28" } ], "dnssec_valid": false, "ip": "185.62.57.28", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-06-07T06:57:37Z", "updated": "2026-08-12T08:51:27Z", "expires": "2027-06-07T06:57:37Z", "nameservers": [ "amy.ns.cloudflare.com", "ajay.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T22:52:48Z", "analysis_at": "2026-10-19T11:58:27Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 14, "suspicious": 3, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-06-08T04:31:07Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "amy.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "ajay.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "185.62.57.28" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ajay.ns.cloudflare.com" } ], "dns_at": "2026-10-19T12:03:46Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "baseinvexus.pro" ], "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "serial": "83a366b89cc721885e394b27380ce593", "sha256": "dbd73739c64002287b96bde25bef90337a4d7eac9612803d17b09d7a63618ee9", "subject": "baseinvexus.pro", "valid_to": "2026-12-18T23:59:59Z", "valid_from": "2026-09-19T00:00:00Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-06-07T06:57:37Z", "last changed": "2026-06-08T09:28:23Z", "registration": "2026-06-07T06:57:37Z", "registrar expiration": "2027-06-07T06:57:37Z", "last update of RDAP database": "2026-10-16T07:13:38Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T22:53:33Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "baseinvexus.pro" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://baseinvexus.pro/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 140 }, "social_tags": { "ogUrl": "https://baseinvexus.pro/", "title": "base invexus | AI Trading Platform | Official Website", "ogType": "website", "robots": "index, follow", "ogTitle": "base invexus | AI Trading Automation & Bot Controls", "ogSiteName": "base invexus", "themeColor": "#0d1118", "description": "base invexus delivers elite automation for trading workflows, featuring AI-assisted trading guidance, bot orchestration, and advanced tools for precise execution and oversight.", "twitterCard": "summary", "canonicalUrl": "https://baseinvexus.pro/", "ogDescription": "base invexus delivers elite automation for trading workflows, featuring AI-assisted trading guidance, bot orchestration, and advanced tools for precise execution and oversight." }, "trackers": { "requests": 23, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 7 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 5 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 40, "wait": 28, "connect": 23, "download": 52 }, "response_ms": 145 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "ocsp_stapled": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 47425, "co2_grams": 0.0017, "cleaner_than": 38 }, "dns_server": { "ns": [ { "ip": "173.245.58.101", "host": "amy.ns.cloudflare.com" }, { "ip": "173.245.59.56", "host": "ajay.ns.cloudflare.com" } ], "zone": "baseinvexus.pro" }, "location": { "ip": "185.62.57.28", "asn": "62370", "org": "Snel.com B.V.", "city": "Rotterdam", "country": "NL" }, "ssl": { "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "subject": "baseinvexus.pro" }, "dns": { "A": [ "185.62.57.28" ], "NS": [ "ajay.ns.cloudflare.com", "amy.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"ajay.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416597719, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "no-referrer-when-downgrade", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "185.62.57.28", "family": 4 }, "redirects": { "chain": [ "https://baseinvexus.pro" ] }, "tech_stack": { "technologies": [ "Cloudflare", "Cloudflare Turnstile", "ClientJS", "Priority Hints", "jsDelivr", "Google Font API", "Font Awesome", "cdnjs", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 11 }, "headers": { "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } } } } ```