g-finwealthfx-investments[.]com

This domain, g-finwealthfx-investments.com, is currently active and flagged as a high-risk brand impersonation threat targeting YouTube. The domain was registered on March 15, 2025, through Sav.com, LLC, and resolved on the report date of July 12, 2026, to IP address 198.12.80.250, which is hosted by AS36352 HostPapa in the United States. The SSL certificate is issued by Let's Encrypt R12, and the HTTP status returns 200, indicating the site is live. The page title is 'G-finwealthfx – Safe investment with wealthfx,' which aligns with the scam type identified as an Investment Scam. Security analysis shows that 11 out of 95 security vendors on VirusTotal flag this domain as malicious, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 out of 100, and the Scamadviser trust score is 1 out of 100, indicating very low trustworthiness. The nameservers used are ns1.korrectserver.com and ns2.korrectserver.com. The domain is described as an investment scam impersonating YouTube, but the exact nature of how it impersonates YouTube is not detailed in the available intelligence. It is uncertain whether the site directly mimics YouTube's interface or uses a lure related to YouTube brand or services. The domain remains active, and no takedown or deactivation has occurred as of the report date. Defenders should treat this domain as a confirmed phishing and scam threat. It should be blocked at the network and email gateway levels. Users who have accessed the domain or provided any personal or financial information should be advised to change credentials and monitor for fraudulent activity. Continued monitoring is recommended to track any changes in IP address, hosting provider, or nameservers, as well as any updates to security vendor detection or blocklist status.