pamparentivon[.]live

The domain pamparentivon.live is currently flagged as a high-risk phishing site targeting users through fraudulent AI-assisted trading offers. Analysis indicates the domain was registered on May 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains active as of July 12, 2026. The page title, 'Pampa Rentivon | Official Platform for AI Assisted Trading,' suggests an attempt to impersonate a legitimate trading service, though no legitimate entity by this name has been verified. The domain resolves to Cloudflare infrastructure (188.114.96.3) hosted in Canada, a common tactic to obscure hosting origins and evade takedowns. Security vendors have detected malicious indicators associated with this domain. VirusTotal reports that 2 out of 95 security engines flag pamparentivon.live as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain appears on at least one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse, indicating limited but confirmed detection in threat feeds. The SSL certificate, issued by Let’s Encrypt (serial number E8), provides basic encryption but does not validate the legitimacy of the site’s content. Infrastructure analysis reveals the use of Cloudflare nameservers (rob.ns.cloudflare.com and selah.ns.cloudflare.com), which may complicate direct IP-based blocking. The HTTP status code 200 confirms the site is accessible, though this does not imply safety. Defenders should treat this domain as actively malicious, particularly in environments where financial or trading-related phishing poses a risk. Network-level blocking via the domain, IP, or associated indicators is recommended. Organizations should also monitor for related domains registered through the same registrar or using similar naming conventions, as threat actors frequently rotate infrastructure to sustain campaigns.