eatfruitinvest[.]com

eatfruitinvest.com was registered on 22 April 2025 through GMO Internet, Inc. and is hosted on a server in Serbia (AS207604 United Internet Ltd.) at IP 185.119.89.185. The domain uses four unlimited.rs name‑servers (dns1‑dns4.unlimited.rs) and presents a valid Let's Encrypt R13 TLS certificate. HTTP requests return status 200 and the page title reads “Provide security and stability for your future – EatFruit invest”, indicating a crypto‑investment narrative. The site is classified as a high‑risk brand‑impersonation campaign targeting the Across brand and is labeled a crypto scam. Ten of ninety‑five VirusTotal scanners flagged the domain, Gridinsoft assigns a trust score of 0 / 100, and it appears on one public blocklist. AlienVault OTX references the domain in a single threat pulse, and PhishDestroy has already blocked it. The infrastructure suggests a short‑lived, opportunistic operation, but the lack of publicly available code samples or login pages leaves the exact harvesting mechanism unclear. Defenders should immediately block the domain and its IP at perimeter and DNS layers, add the name‑servers to watch lists, and monitor for related traffic to the AS207604 network. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this host.