# PhishDestroy threat dossier — x-based.icu ================================================================ Fetched: 2026-05-06 15:57:20 UTC Canonical: https://phishdestroy.io/domain/x-based.icu/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Base ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, CyRadar, Forcepoint ThreatSeeker, Fortinet, Google Safebrowsing ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: ["curt.ns.cloudflare.com", "danica.ns.cloudflare.com"] Registered: 2026-05-03 Page title: Just a moment... HTTP response: 526 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-07-29 Status: INVALID chain Fingerprint: 88589df51c6699639c59edceb4cd2be1ab72c81403325c86f4668327d4dcb218 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-03 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-03 21:20:38 UTC (by PhishDestroy tracker) Last verified: 2026-05-06 18:47:03 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019def0f-668b-72fe-b0d7-f6c28c2f9ddb/ Wayback Machine: https://web.archive.org/web/*/x-based.icu crt.sh CT logs: https://crt.sh/?q=%25.x-based.icu Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=x-based.icu AlienVault OTX: https://otx.alienvault.com/indicator/domain/x-based.icu URLhaus: https://urlhaus.abuse.ch/host/x-based.icu/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-03 21:21:35 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies an active brand impersonation campaign using the domain x-based.icu to fraudulently pose as Base, a cryptocurrency exchange and financial platform. The threat actor is leveraging exact visual replication of Base’s branding to deceive users into surrendering login credentials or transferring digital assets under false pretenses. This domain was flagged by PhishDestroy on May 2, 2026, and is currently under investigation due to its high-risk potential and lack of detection across security platforms. This domain poses a direct financial and identity theft risk to Base users through credential harvesting and social engineering. The domain x-based.icu was created on April 30, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.96.3 and has not been flagged by any of the 95 VirusTotal scanners as of the time of writing. The absence of detection, combined with the use of a valid Let’s Encrypt SSL certificate, increases the likelihood of successful deception. The threat actor is likely disseminating links via email, social media, or messaging platforms under the guise of official Base communications, such as account alerts, promotions, or security notifications. Users who have visited x-based.icu should immediately assume their credentials may have been compromised and take urgent action. Do not log in or enter any sensitive information on the site. Revoke any session tokens or API keys that may have been exposed. Enable multi-factor authentication (MFA) on all Base accounts and monitor for unauthorized transactions. Report any suspicious activity to Base support and change passwords using a trusted device. Block the domain and IP (188.114.96.3) at the network level if possible. Users should remain vigilant for follow-up phishing attempts, as compromised credentials are often leveraged in secondary attacks. Always verify URLs and use official Base domains (base.xyz) for all interactions. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: ef55c91353a420f069a0ac28797e8ade TLS cert SHA-256: 88589df51c6699639c59edceb4cd2be1ab72c81403325c86f4668327d4dcb218 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/x-based.icu/ JSON API: https://api.destroy.tools/v1/check?domain=x-based.icu Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 146,383 domains (59,731 alive under monitoring, 86,391 confirmed takedowns/dead). Site: https://phishdestroy.io