dolu-yatirimotiv[.]live

This domain, dolu-yatirimotiv.live, is identified as a fraudulent investment platform targeting users with false claims of AI-assisted trading services. The site operates under the fabricated brand 'Dolu Yatirimotiv,' presenting itself as an official trading platform to deceive victims into depositing funds. No specific drainer kit signatures were detected, but the infrastructure aligns with common investment scam patterns, including the use of Cloudflare for hosting and content delivery networks to obscure malicious activity. Analysis indicates the domain was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.157.129, a Cloudflare proxy endpoint, which complicates direct attribution. VirusTotal reports 5 out of 95 security vendors flagging the domain for malicious activity, while it appears on two independent security blocklists. Technologies detected include Unpkg, jsDelivr, jQuery, and IPinfo, suggesting a reliance on third-party libraries and geolocation services to enhance the scam's credibility. The domain's SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. As of the latest assessment, dolu-yatirimotiv.live has been taken offline, likely due to enforcement actions or abandonment by the threat actors. However, the risk remains elevated due to the potential for re-registration or migration to a new domain. Users who interacted with the platform are advised to monitor financial accounts for unauthorized transactions, revoke access to any linked services, and report the incident to relevant authorities. Organizations should update blocklists to include this domain and its associated indicators, while security teams should analyze network logs for connections to the IP address 172.67.157.129 or related infrastructure.