stockforexinvestment[.]com

This domain, stockforexinvestment.com, is flagged as an active forex investment scam as of July 12, 2026. Infrastructure analysis reveals it resolves to IP address 172.67.147.247, a Cloudflare-protected endpoint utilizing HTTP/3, which may obscure origin server details. The domain was registered on March 27, 2025, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently observed in fraudulent registrations. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, providing basic encryption without vetting domain legitimacy. Security vendor detections indicate mixed but concerning signals: five of 95 vendors on VirusTotal classify this domain as malicious. Additionally, it appears in 15 threat intelligence pulses on AlienVault OTX and is listed on two security blocklists, including PhishDestroy and BLP-Malware. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. The page title, 'stockforexinvestment,' suggests a focus on financial trading, though the exact content and targeted brands remain unconfirmed due to the absence of deeper content analysis. Defenders should treat this domain as a confirmed threat vector. Recommended actions include blocking resolution at the DNS or firewall level, monitoring for connections to 172.67.147.247, and alerting users to potential phishing attempts linked to forex or investment schemes. The domain's continued activity and protective infrastructure (Cloudflare) indicate ongoing malicious intent. Further investigation into associated email addresses, registration details, and hosting patterns may reveal additional linked threats.