# PhishDestroy threat dossier — game-waybase.com ================================================================ Fetched: 2026-07-30 10:24:41 UTC Canonical: https://phishdestroy.io/domain/game-waybase.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 90/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/95 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CyRadar, Fortinet, Lionic, Seclookup, Sophos, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- Registered: 2026-02-21 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-26 23:24:26 UTC (by PhishDestroy tracker) First reported: 2026-02-26 23:24:26 UTC (abuse notice filed) Last verified: 2026-07-30 12:21:18 UTC Neutralised: 2026-04-11 12:14:54 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/0198b5de-9209-72b8-84d5-cb9a7a948b9c/ Wayback Machine: https://web.archive.org/web/*/game-waybase.com crt.sh CT logs: https://crt.sh/?q=%25.game-waybase.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=game-waybase.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/game-waybase.com URLhaus: https://urlhaus.abuse.ch/host/game-waybase.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-24 23:56:19 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] game-waybase.com — Brand Impersonation Phishing Investigation The domain game-waybase.com was identified as a brand impersonation phishing site on July 24, 2026. This domain was created on February 21, 2026, and has been flagged by 7 out of 95 security vendors on VirusTotal, indicating a potential threat. The domain also appears on one security blocklist, specifically PhishDestroy, which is a notable indicator of malicious intent. The Gridinsoft trust score for this domain is 0 out of 100, reflecting a complete lack of trust in its legitimacy. The current status of the domain is offline, suggesting that it may have been taken down by security researchers, domain registrars, or law enforcement. However, the exact reason for the takedown is not specified in the available intelligence. Despite the domain being offline, it is important for defenders to remain vigilant, as phishing domains often reappear under different names or with slight modifications. The offline status does not guarantee that the threat is completely neutralized, and residual infrastructure or associated domains may still pose risks. Defenders should ensure that this domain is blocked at the network level and monitor for any related activity. Additionally, users should be educated to recognize and report brand impersonation attempts, as these types of scams often rely on social engineering to deceive victims. The exact content and structure of the phishing site have not been analyzed, and no further details are available regarding the specific brand being impersonated or the methods used to carry out the phishing attack. Nonetheless, the combination of a low trust score, blocklisting, and vendor flags provides sufficient evidence to classify this domain as a high-risk threat. Regular updates to security lists and continuous monitoring are recommended to protect against any potential reactivation of the domain or similar threats. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/game-waybase.com/ JSON API: https://api.destroy.tools/v1/check?domain=game-waybase.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,592 domains (88,773 alive under monitoring, 104,557 confirmed takedowns/dead). Site: https://phishdestroy.io