pamadolexio[.]live

The domain pamadolexio.live has been identified as a phishing site specifically targeting users through a fraudulent AI-assisted trading platform scheme. Analysis indicates this is not a generic phishing attempt but a targeted scam impersonating automated trading services to deceive victims into disclosing financial credentials or transferring cryptocurrency. As of the latest verification, the domain is reported offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.53.105, a Cloudflare-protected endpoint, and was created on May 25, 2026—an anomalous future date suggesting potential domain spoofing or incorrect WHOIS records. The site was flagged by 2 of 95 security vendors on VirusTotal, appears on one security blocklist, and received a trust score of 0/100 from Gridinsoft. Detected technologies include Cloudflare, jsDelivr, jQuery, and IPinfo, with an SSL certificate issued by Let’s Encrypt, indicating a layered but low-effort obfuscation strategy. Current status confirms the domain is offline, though residual risk persists for users who may have interacted with it prior to takedown. Organizations and individuals are advised to block the domain and its associated IP at the network level, revoke any credentials potentially exposed through this site, and monitor for unauthorized transactions. Security teams should treat this as part of a broader trend of AI-themed financial scams and update detection rules to include the registrar, IP range, and SSL issuer patterns observed here. Historical logs should be reviewed for connections to 104.21.53.105 or domains with future-dated WHOIS records.