invescoop[.]com

This domain, invescoop.com, has been identified as a generic phishing site designed to impersonate Invesco Investments, a legitimate financial services provider. The site operates as a credential-harvesting portal, presenting users with fraudulent login interfaces to extract sensitive financial information. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used in phishing campaigns targeting investors. Infrastructure analysis reveals invescoop.com was registered through GoDaddy.com, LLC on September 30, 2013, an unusually long registration period that may have been exploited to lend false legitimacy. The domain resolves to the IP address 104.21.81.116, a Cloudflare-associated address often used to obscure hosting origins. Detection metrics show the domain was flagged by 1 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist, and its page title, "Invesco Investments," directly mimics the branding of the legitimate entity to deceive users. As of the latest assessment, invescoop.com remains offline, though its historical activity and infrastructure warrant continued monitoring. Organizations and individuals are advised to block the domain and its associated IP (104.21.81.116) at the network level. Users should verify the authenticity of financial portals by cross-referencing official domains and enabling multi-factor authentication on all investment accounts. Security teams are encouraged to review logs for prior interactions with this domain and conduct awareness training to mitigate similar phishing threats.