agrofertinvestment[.]live

The domain agrofertinvestment.live has been identified as a brand impersonation threat specifically targeting investment scam victims. Analysis confirms the domain was designed to mimic legitimate AI-assisted trading platforms, presenting itself as an official investment portal. As of the latest verification, this infrastructure has been taken offline, though historical activity remains a concern for retrospective threat analysis. Infrastructure analysis reveals the domain was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 27, 2026, with an anomalous future creation date suggesting potential domain spoofing or incorrect registry records. The domain resolved to the IP address 188.114.97.3 and held a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy to phishing sites. It appeared on one security blocklist and received a trust score of 0/100 from Gridinsoft, further corroborating its malicious classification. The page title, 'Agrofert Investment | Official Platform for AI Assisted Trading,' explicitly impersonates financial service branding to deceive potential investors. Current status indicates the domain is offline, reducing immediate risk to end users. However, the infrastructure may re-emerge under similar naming conventions or associated IPs. Organizations and individuals are advised to monitor for recurring patterns, including domains registered through NICENIC INTERNATIONAL GROUP with future-dated creation timestamps or those resolving to 188.114.97.3. Network defenders should block the domain and IP at perimeter controls, while end users should verify investment platforms through official channels only. Historical indicators, such as the SSL issuer and registrar, should be incorporated into threat intelligence feeds for proactive detection of related campaigns.