investigbot[.]com

PhishDestroy identifies investigbot.com as an active credential-harvesting scam site designed to trick users into submitting login details under the guise of a threat intelligence tool. The domain mimics legitimate security services to deceive visitors into believing they are accessing a professional platform, when in reality, any inputted credentials are immediately compromised and likely sold on dark web markets or used for follow-on attacks. Users who interact with this site risk exposing corporate, personal, or financial account credentials to malicious actors.

This domain was flagged by 6 of 95 VirusTotal security vendors, registered on December 11, 2024, and hosted on IP 66.29.142.74 through NAMECHEAP INC with a Let's Encrypt SSL certificate. Its recent creation and low detection rate at time of analysis (6/95) suggest it is part of an emerging campaign, leveraging newly registered domains to evade early detection mechanisms. The use of a free SSL certificate further enhances its credibility deception, as visitors may assume the site is trustworthy due to the padlock icon in their browser.

If you visited investigbot.com, do not enter any credentials, personal information, or financial data. Immediately change passwords for any accounts you may have entered, enable multi-factor authentication on all critical accounts, and scan your device for malware using a reputable security tool. Report the domain to your IT security team or file a complaint with your national cybercrime unit. Monitor accounts closely for unauthorized access and consider using identity theft protection services if sensitive data was submitted. Avoid revisiting the site, as it remains active and poses an ongoing risk.