aiinvest[.]cc

The domain aiinvest.cc has been identified as an active impersonation site targeting investment platforms, specifically mimicking a one-stop global trading service. Analysis confirms this as a brand impersonation threat under the category of investment scams, currently marked as offline. The site presented itself as a trading platform offering forex, commodities, stocks, indices, cryptocurrencies, gold, and oil under the fabricated brand name 'Likefire.' Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3. It holds a Gridinsoft trust score of 0 out of 100, indicating high-risk classification. Security vendors on VirusTotal flagged the domain in 15 of 95 scans, while AlienVault OTX includes it in two distinct threat intelligence pulses. The domain appears on four security blocklists and is actively blocked by multiple threat protection systems, including MetaMask and PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. As of the latest assessment, aiinvest.cc has been taken offline, though historical data suggests potential for reemergence under similar infrastructure. Organizations and individuals are advised to block the domain and associated IP at the network level. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. Users who interacted with the site should review financial accounts for unauthorized activity and reset credentials for any linked services.