ai-like[.]net

ai-like.net was registered on June 12 2026 through Namecheap Inc. and resolves to the IP 192.64.119.135, which is geo‑located in the United States and listed as a Web‑hosting.com address. The web server is Nginx and serves HTTP responses with status code 200. No TLS certificate is presented, meaning all traffic is plaintext. The domain uses the public nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. Threat intel assigns a high risk rating. Gridinsoft gives the domain a trust score of 0 / 100. VirusTotal reports that 18 out of 95 security scanners flag the host as malicious. AlienVault OTX has linked the domain in eight separate threat‑intelligence pulses. The site is currently blocked by PhishDestroy and appears on one external security blocklist. The generic phishing classification is corroborated by multiple sources. While the domain is confirmed as a generic‑phishing infrastructure, the specific brand or service being spoofed has not been identified in the available data. The absence of a TLS certificate may deter some users but also suggests the operators are not attempting to masquerade a legitimate secure site. The short lifespan—just over a month—indicates a rapid‑deployment model typical of credential‑harvesting campaigns. Defenders should add 192.64.119.135 and the host name ai-like.net to outbound filtering and DNS sinkhole rules. Continuous monitoring of DNS queries for the two registrar‑provided nameservers can reveal further campaign expansion. Because the site delivers content over HTTP, network‑level inspection can capture payloads for forensic analysis. End‑user awareness training should emphasize the lack of HTTPS and the presence of suspicious domain patterns.