invest-program-kz24[.]info

This domain, invest-program-kz24.info, operates as a fraudulent cryptocurrency investment portal designed to deceive users into transferring digital assets under false pretenses. The page title, "Главная @ Invest Program KZ," suggests a localized scheme targeting Russian-speaking users, likely presenting fabricated investment opportunities with promises of high returns. The site employs common social engineering tactics, including professional design elements and third-party JavaScript libraries such as Tippy.js and AOS, to create an illusion of legitimacy. Infrastructure analysis reveals the use of Cloudflare services, which may obscure the true origin of the malicious activity and complicate takedown efforts. Evidence supporting the classification of this domain as malicious includes its presence on three security blocklists, despite a current VirusTotal detection rate of 0/95. The domain was registered on March 22, 2026, through Dynadot Inc, a registrar frequently associated with abusive registrations. It resolves to the IP address 104.21.2.232, a Cloudflare proxy endpoint, and utilizes technologies such as Unpkg, jsDelivr, and HTTP/3 to enhance functionality and evade detection. The SSL certificate is issued by Let’s Encrypt, a common practice among both legitimate and malicious sites to establish encrypted connections. The domain’s current offline status may indicate a temporary suspension or a strategic shift in infrastructure by the threat actor. Users who have visited invest-program-kz24.info or interacted with its content should take immediate remedial actions. Any credentials, wallet addresses, or personal information entered on the site should be considered compromised. Affected individuals are advised to revoke access to any linked cryptocurrency wallets, monitor accounts for unauthorized transactions, and report the incident to relevant financial or cybersecurity authorities. Additionally, users should scan their devices for malware, as phishing sites may deploy additional payloads. Vigilance is recommended when encountering similar investment schemes, particularly those hosted on newly registered domains or leveraging content delivery networks for obfuscation.