orveztil-it[.]live

This domain is flagged as an elevated-risk phishing infrastructure targeting users of AI-based trading platforms. Analysis indicates it operates under the guise of an official trading service, specifically leveraging the branding of an AI-driven investment platform to deceive victims into disclosing sensitive credentials, financial details, or installing malicious software. The threat type is classified as generic phishing with a focus on financial fraud, likely aimed at Italian-speaking users given the language used in the page title. Infrastructure analysis reveals the domain orveztil-it.live was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 26, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. It resolves to the IP address 188.114.96.3 and uses a Let's Encrypt SSL certificate, a common tactic to appear legitimate. The domain is detected by 9 out of 95 security vendors on VirusTotal, holds a Gridinsoft trust score of 0/100, and appears on at least one security blocklist. It was also blocked by PhishDestroy prior to being taken offline. The page title, 'Orveztil | Piattaforma ufficiale di trading con IA,' reinforces its fraudulent intent by mimicking a trusted trading service. Mitigation steps for this threat include immediate blocking of the domain and its associated IP (188.114.96.3) at the network perimeter. Organizations should monitor for any residual connections to this infrastructure, particularly from endpoints accessing financial or trading-related services. Users who may have interacted with the domain should be advised to reset credentials for any trading or financial platforms, enable multi-factor authentication, and scan systems for unauthorized access or malware. Financial institutions and trading platforms should issue alerts to customers about this phishing campaign, emphasizing verification of official domains before entering sensitive information.