cryptocurrencyinvestigationbook[.]com

This domain, cryptocurrencyinvestigationbook.com, was registered through Porkbun LLC on 06 March 2026. The authoritative nameservers curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com and maceio.ns.porkbun.com resolve the domain to the IP address 44.227.76.166, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. An SSL certificate issued by Let’s Encrypt (R12) is present, indicating that HTTPS connections are possible, although the site currently returns an expired‑domain page titled “porkbun.com | expired domain”. The domain is listed on three external security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that five of ninety‑four scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. The threat is classified as a generic phishing operation that aligns with an investment‑scam profile. The site is presently taken offline, but the infrastructure components—hosting on Amazon AWS, the Let’s Encrypt certificate, and the Porkbun registration—remain reusable for future malicious campaigns.

Defenders should continue to denylist the IP 44.227.76.166, enforce blocklist entries, and monitor the domain for potential re‑registration. Additional scrutiny of any future TLS certificates or changes to the nameserver set is advised. Because the page content has not been captured, the exact phishing lure cannot be described, and analysts should treat any forthcoming content as unverified until examined.