aimodelitalia[.]com

This domain, aimodelitalia.com, is actively flagged as a high-risk Instagram brand impersonation site targeting Italian-speaking users. Analysis indicates the domain was registered on December 7, 2025, through Tucows Domains Inc. and currently resolves to IP 64.29.17.65, hosted on Amazon's AS16509 in the United States. The site presents itself as 'AI Models Academy | Monetizza con l'Intelligenza Artificiale,' suggesting a social media monetization scam leveraging artificial intelligence themes to lure victims. Infrastructure reveals nameservers under Njalla (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a provider often used for privacy-focused or malicious domains. The site employs a 307 HTTP redirect, which may indicate intermediate tracking or cloaking behavior.

SSL is provided by Let's Encrypt (R12), a common choice for both legitimate and fraudulent sites. Technologies detected include Vercel, HSTS, and Calendly, which may be used to legitimize the operation or facilitate victim engagement. Security vendors have flagged this domain, with 10 of 95 engines on VirusTotal detecting malicious activity. It appears on two security blocklists (PhishDestroy and ScamSniffer) and is referenced in one AlienVault OTX threat intelligence pulse.

Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. While the exact content and mechanics of the phishing kit remain unanalyzed, the combination of Instagram impersonation, AI-themed monetization claims, and technical indicators strongly suggests a social media credential harvesting operation. Defenders should block this domain at the DNS and proxy levels, monitor for connections to 64.29.17.65, and investigate any internal access attempts. Further analysis of the site's redirect chains and backend infrastructure is recommended to identify additional IOCs.