cryptocurrencyinvestigationsbodyofknowledge[.]com

The domain cryptocurrencyinvestigationsbodyofknowledge.com was registered on March 06, 2026 through Porkbun LLC and is currently taken offline. DNS resolution points to the single IPv4 address 44.227.76.166, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The authoritative nameservers listed for the domain are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, and maceio.ns.porkbun.com. An SSL certificate issued by Let’s Encrypt (R13) was observed, indicating that HTTPS was enabled at some point. The only page title retrieved from the site is "porkbun.com | expired domain," suggesting that the domain may have been parked or redirected to a registrar‑controlled expiration notice after the malicious content was removed.

Security telemetry shows that two of ninety‑four VirusTotal scanners flagged the domain, and three independent blocklists (PhishDestroy, MetaMask, and SEAL) have added it to their deny lists. The domain also appears on three additional security blocklists, reinforcing the assessment that it was used for malicious activity. The listed scam type is "Investment Scam," and the threat category is recorded as generic phishing. No further behavioral data, such as payload samples or phishing page screenshots, are available, leaving the exact modus operandi unconfirmed.

Given the observed infrastructure, defenders should continue to block the domain and its IP address at perimeter and DNS filtering layers. Monitoring for any re‑registration of the same name or reuse of the associated IP range is advised, as the Amazon hosting environment could be repurposed for new campaigns. Analysts should also correlate any future alerts that reference the three Porkbun nameservers or the Let’s Encrypt certificate fingerprint to detect potential re‑use of the same certificate chain. While the site is offline, the historical indicators provide sufficient evidence for an elevated risk rating and justify ongoing containment measures.