investake[.]app

investake.app was registered through Cloudflare, Inc. and uses the Cloudflare nameservers beth.ns.cloudflare.com and donald.ns.cloudflare.com. The domain resolves to the IP address 172.253.63.147, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate was observed; the site served HTTP only. The page title returned by the HTTP response is “Google”, matching the declared brand target of Google.

VirusTotal analysis shows that one of ninety‑five scanning engines flagged the domain, indicating at least one detection. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on two external blocklists, PhishDestroy and ScamSniffer. The listed scam type is “Crypto Scam”, suggesting the site was used to solicit cryptocurrency payments under the pretense of a Google‑related offering. The domain is currently taken offline, and no further HTTP content is available for deeper inspection.

The available evidence confirms that the infrastructure is deliberately aligned with Google’s branding to increase credibility, while the lack of SSL and the minimal detection footprint point to a low‑profile deployment. Uncertainty remains regarding the specific payload or payment addresses used, as no page content or network traffic has been captured. Defenders should block the domain at perimeter filters, add the IP 172.253.63.147 to deny lists, and monitor for any future re‑registration attempts. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection status, and organizations should educate users about unsolicited cryptocurrency requests that reference Google.