optimawiseinvest[.]xyz

This domain, optimawiseinvest.xyz, is actively impersonating Google under the guise of a Bitcoin trading platform, as indicated by its page title 'Optima Wise Invest | Bitcoin Trading Platform' and confirmed brand impersonation targeting Google. Registered on December 1, 2024, through Dynadot LLC, the domain resolves to IP 107.172.61.186 (US, AS36352 HostPapa) and is currently returning an HTTP 200 status, signaling an operational endpoint. Analysis reveals a single nameserver configuration, which may simplify takedown efforts but also suggests a low-cost, disposable infrastructure. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains, providing no definitive indicator of compromise on its own. Five of 95 security vendors on VirusTotal have flagged this domain, a modest detection rate that may reflect limited visibility or evasion techniques. It appears on one security blocklist (PhishDestroy) and is classified as a tech-support scam. The Gridinsoft trust score of 16/100 further corroborates its malicious classification. Defenders should note that while the domain is young (seven months old), its persistence and active status indicate ongoing risk. No evidence of a phishing kit or specific payload is present in the available data, but the combination of brand impersonation, cryptocurrency-themed content, and tech-support scam classification suggests a likely vector for credential harvesting or fraudulent transactions. Recommended actions include blocking the domain and its resolving IP at the perimeter, monitoring for internal connections to 107.172.61.186, and alerting users to the tech-support scam classification. If internal access is detected, investigate for potential credential exposure or unauthorized financial transactions. Given the domain's low detection rate and single blocklist appearance, additional hunting for related infrastructure (e.g.