kinginvestment[.]ltd

This domain, kinginvestment.ltd, operates as a fraudulent investment portal designed to deceive users into disclosing financial credentials or transferring cryptocurrency under false pretenses. Analysis indicates the site mimics legitimate investment platforms, employing social engineering tactics to exploit victims seeking high-return opportunities. The infrastructure is engineered to harvest sensitive data, including wallet addresses and login credentials, which are then used for unauthorized transactions or sold on underground forums. Infrastructure analysis reveals the domain was registered on May 23, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with high-risk domains. VirusTotal reports 9 out of 95 security vendors have flagged the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse. The domain resolves to IP address 104.21.4.137, a Cloudflare-associated endpoint that obscures the true origin of the hosting infrastructure. Despite its recent creation, the domain remains active and continues to evade takedown efforts, likely due to rapid DNS and IP rotation. Users who have visited kinginvestment.ltd or interacted with its content should immediately revoke access to any linked financial accounts or cryptocurrency wallets. Monitor all connected accounts for unauthorized transactions, particularly those involving cryptocurrency transfers. If credentials were entered, reset passwords using a secure, isolated device and enable multi-factor authentication where available. Report the incident to relevant financial institutions and consider filing a complaint with local cybercrime authorities. Block the domain and its associated IP (104.21.4.137) at the network level to prevent further exposure.