aifxtrading[.]live

This domain, aifxtrading.live, is actively flagged as a high-risk fake exchange scam. Registered on February 27, 2026, through Dynadot LLC, it resolves to IP address 62.84.182.192, hosted on AS51167 (Contabo GmbH) in France. The domain is currently blocked by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a trust score of 0/100 from Gridinsoft. Despite returning an HTTP 200 status, the page title reads 'Sorry, the website has been stopped,' which may indicate a temporary takedown attempt or a placeholder for future malicious activity. Infrastructure analysis reveals the domain uses nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, a configuration often associated with bulletproof or low-reputation hosting providers. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its free and automated issuance process. While only 2 out of 95 security vendors on VirusTotal flag this domain, this low detection rate does not confirm safety; many phishing domains evade initial detection by leveraging newly registered infrastructure or low-visibility campaigns. The scam type is explicitly classified as a fake exchange, though the exact content and mechanics of the fraudulent operation remain unconfirmed. The domain's recent registration, combined with its presence on multiple blocklists and association with known malicious infrastructure, suggests it is part of an active phishing campaign targeting users of cryptocurrency or financial platforms. Defenders should treat this domain as hostile and prioritize blocking it at the DNS, proxy, or firewall level. Additionally, monitoring for related domains using the same nameservers or IP range (62.84.182.0/24) may help identify further malicious activity. No legitimate financial service is expected to operate from this infrastructure.