investiturein[.]com

This domain is flagged as a high-risk brand impersonation targeting Ethereum. The domain investiturein.com was registered on April 30, 2025, through NameSilo, LLC, and resolves to IP address 107.172.61.186, hosted in the United States on AS36352 (HostPapa). The domain currently returns an HTTP 200 status and is still active as of the report date. The page title is HOME PAGE | INVESTITURE, and the site employs several technologies including particles.js, UIKit, LiteSpeed, Smartsupp, jQuery, Crisp Live Chat, and HTTP/3. An SSL certificate from Let's Encrypt (R12) is present, which is common among both legitimate and malicious sites. The MX records point to the domain itself with a priority of 0, indicating a non-standard mail configuration. The domain appears on one security blocklist, PhishDestroy, and VirusTotal shows 5 out of 95 security vendors flagging this domain as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of high risk. The exact content of the page has not been visually analyzed, but the combination of a low trust score, security vendor flags, and the brand impersonation classification strongly suggests this domain is part of a cryptocurrency scam. It is uncertain whether the domain is actively harvesting credentials or promoting a fraudulent investment scheme, but the presence of live chat services (Smartsupp and Crisp Live Chat) indicates the operators may be engaging with visitors in real time. Defenders should treat this domain as malicious and block access at the network and email levels. Users who have interacted with the site should be warned about potential credential theft or financial loss. Monitoring for subdomains or related infrastructure under the same registrar or IP range is recommended, as phishing campaigns often spin up multiple domains to evade takedown. The domain remains active, so immediate blocking is advised pending further investigation or removal by the hosting provider.