growthnest-investment[.]com

This domain is flagged as a high-risk brand impersonation phishing site targeting AAR Global Construction Ltd. Analysis indicates the domain is designed to deceive users into believing they are interacting with a legitimate construction firm, likely to harvest credentials, financial details, or propagate further social engineering attacks. The threat type is classified as generic_phishing with a focus on brand impersonation, a tactic commonly used to exploit trust in established corporate identities. Infrastructure analysis reveals the domain resolves to IP address 163.61.188.9, hosted on AS153568 (NEW DHAKA HARDWARE) in the United States. It is registered through TuringSign Inc. d/b/a Cosmotown, with a creation date of November 28, 2025, suggesting recent deployment. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while PhishDestroy has already blocked it. The domain appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (R13). The page title, 'AAR Global Construction Ltd | Home,' further confirms the impersonation attempt. Mitigation steps should include immediate blocking of the domain and its associated IP (163.61.188.9) at the network perimeter. Security teams are advised to monitor for internal traffic to this domain, particularly from users who may have interacted with construction or financial-related communications. Endpoint detection rules should be updated to flag any processes attempting to connect to growthnest-investment.com or its resolved IP. User awareness training should emphasize the risks of brand impersonation, particularly in sectors like construction where financial transactions are frequent. Additionally, organizations should verify the legitimacy of domains claiming affiliation with AAR Global Construction Ltd by cross-referencing official contact details and SSL certificate transparency logs.