aicopmtrade[.]click

This domain, aicopmtrade.click, was registered on April 01, 2026 through Global Domain Group LLC and resolves to the Cloudflare‑hosted address 104.21.21.60 (AS13335, United States). The site is protected by a Let’s Encrypt certificate (issuer YE1) and serves content over HTTP/3 using Cloudflare services, with server‑side components identified as Node.js, Express, Bootstrap and Cloudflare Browser Insights. The visible page title is “Log in to your PayPal account”, indicating a credential‑phishing campaign that impersonates PayPal. Google Safe Browsing classifies the URL as social engineering, and the domain appears on one external security blocklist. VirusTotal reports that 25 of 91 scanned vendors flag the domain as malicious, and AlienVault OTX has referenced it in two separate threat‑intel pulses.

Additional defenses have marked the host as hostile: PhishDestroy blocks it, and Gridinsoft assigns a trust score of 0 / 100. The current operational status is offline, which suggests the phishing site has been taken down or is no longer serving content. Analysis confirms the infrastructure is typical of low‑cost phishing kits hosted behind Cloudflare, leveraging dynamic content delivery to obscure origin. While the domain’s content cannot be verified directly, the combination of the PayPal‑specific page title, the social‑engineering Safe Browsing flag, and multiple vendor detections provide strong evidence of a credential‑phishing intent.

Uncertainty remains regarding the exact phishing kit version and any additional payloads that may have been delivered before takedown. Defenders should continue to block aicopmtrade.click at DNS and proxy layers, monitor for any resurgence of the same host‑header or similar page titles, and add the domain to internal watchlists. Threat‑intel teams may also consider sharing the indicator set (domain, IP, nameservers, certificate fingerprint) with upstream feeds to improve collective detection.