aiinvestmaximum-es[.]live

PhishDestroy analysts identified the domain aiinvestmaximum-es.live as an active brand impersonation site leveraging crypto drainer toolkits to siphon cryptocurrency from unsuspecting users. The domain mimics legitimate investment platforms to deceive visitors into connecting wallets and signing malicious transactions. Initial triage indicates this is part of a broader campaign targeting users searching for high-yield investment opportunities, with domain registration and hosting infrastructure tuned for evasion and rapid rotation.

Technical indicators confirm this domain is a high-risk asset. Resolving to IP 104.21.14.100, the domain was registered on May 11, 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal currently reports 3/95 detections, showing no flags from AV engines. A Let’s Encrypt SSL certificate is in use, suggesting an attempt to appear legitimate. The domain remains unblocked in Google Safe Browsing (GSB) and has not yet been added to major threat intelligence feeds or blocklists (0 current listings).

This domain is classified as ACTIVE with a status of UNDER_INVESTIGATION. While no drainer kit fingerprint has been publicly disclosed, behavioral analysis suggests the use of a crypto drainer script similar to those observed in recent impersonation campaigns targeting financial platforms. The threat level remains elevated due to the absence of detection coverage and the domain’s recent creation date. Users are advised to block aiinvestmaximum-es.live at the network and endpoint levels. Security teams should monitor for traffic to this domain and inspect outbound connections to 104.21.14.100. Remaining risk is high until the drainer payload is identified and signatures are deployed across defenses.