# basicpension.028426.com — MALICIOUS

> basicpension.028426.com flagged by 15/95 VirusTotal vendors for pension scam phishing. Check the full report.

## Summary
PhishDestroy identifies basicpension.028426.com as an active pension scam phishing domain currently engaged in fraudulent activities. The domain mimics legitimate pension-related services to deceive users into surrendering sensitive personal or financial information under false pretenses. This campaign specifically targets individuals concerned with retirement planning, leveraging trust in established pension terminology to increase the likelihood of exploitation.  

This domain was flagged by 15 out of 95 VirusTotal vendors, placing it on 1 security blocklist. It resolves to IP 34.194.247.17 and was registered through MarkMonitor Inc. on January 12, 2017. The domain holds a valid SSL certificate issued by Let's Encrypt, which may be used to enhance its perceived legitimacy among potential victims. Trust scores and historical data suggest persistent misuse over several years, despite its seemingly innocuous registration details.  

Current indicators confirm the domain remains active and poses an elevated risk to unsuspecting users. PhishDestroy recommends immediate avoidance and blocking of basicpension.028426.com at the network and endpoint levels. Users who may have interacted with this domain are advised to monitor financial accounts for unauthorized activity and report any suspected exposure to relevant authorities or identity protection services. Organizations should update firewall and DNS blocklists to prevent access. Exercise heightened scrutiny toward any unsolicited communication referencing pension services.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2017-01-12 18:03:41
- Registrar: MarkMonitor Inc.
- IP: 34.194.247.17

## Detection Status
- VirusTotal: 15 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishingDB"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/b1e68c84-4dbe-43f9-8b7d-d26295a64de4
- PhishDestroy: https://phishdestroy.io/domain/basicpension.028426.com/
- LLM endpoint: https://phishdestroy.io/domain/basicpension.028426.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/basicpension.028426.com/
Last updated: 2026-04-01