investment-broker[.]xyz

The domain investment-broker.xyz was registered on February 21, 2026 and is currently taken offline. Analysis of open‑source intelligence shows that it has been listed on a single security blocklist and appears in one AlienVault OTX pulse, indicating that at least one threat‑intel feed has correlated the domain with malicious activity. VirusTotal scans returned detections from 15 of 93 security vendors, reinforcing the suspicion of abuse. The site resolves to IP address 199.59.243.228, which is hosted by Amazon.com, Inc. (AS16509) in the United States. The SSL certificate associated with the domain is identified as "R12," a low‑trust certificate that offers minimal validation.

Reputation services assign extremely low scores: Gridinsoft rates the domain 0 / 100 and Scamadviser 1 / 100, both suggesting a high likelihood of fraudulent operation. The page title returned by HTTP requests is simply "investment-broker.xyz," providing no additional context about the content. The threat categorisation in the available data labels the activity as a "Crypto Scam," implying that the site was used to solicit cryptocurrency payments under false pretences. Defensive teams should treat any traffic to or from this domain as hostile.

Indicators of compromise include the domain name, its registration date, the hosting IP 199.59.243.228, and the SSL certificate fingerprint. Organizations should block the domain and the associated IP at perimeter defenses, update intrusion‑detection signatures with the VirusTotal detection count, and monitor for any residual connections that may persist in compromised hosts. Because the site is offline, active exploitation is unlikely, but remnants of the infrastructure may remain in use for credential harvesting or further phishing campaigns. Continuous monitoring of the IP range belonging to AS16509 for similar low‑trust domains is recommended to pre‑empt future abuse.