investingcoins[.]vip

This domain, investingcoins.vip, is flagged as part of a cryptocurrency investment scam operation designed to drain digital assets from victims. Analysis indicates the site likely employs crypto drainer techniques, tricking users into connecting wallets to malicious smart contracts that siphon funds. No direct brand impersonation is confirmed, though the domain name suggests fraudulent investment opportunities targeting cryptocurrency holders. The infrastructure lacks overt ties to known phishing kits, but the tactics align with broader crypto-theft campaigns observed in recent months. Technical indicators reveal the domain was registered on May 02, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 18.245.31.19, hosted on infrastructure linked to Amazon Web Services, specifically leveraging Amazon S3 and CloudFront services. The SSL certificate is issued by Amazon, a common configuration for cloud-hosted phishing sites. As of the latest scan, VirusTotal reports 0/95 detections, indicating no antivirus engines have flagged the domain yet. However, it appears on two security blocklists, and Gridinsoft assigns a trust score of 0/100, reflecting high suspicion. Google Safe Browsing status is not explicitly provided but is likely flagged given the blocklist presence. The domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains a concern, as threat actors may redeploy the scam under a new domain or IP. Historical patterns suggest similar campaigns reuse cloud hosting providers and registrars with lax abuse policies. Users who interacted with the site should revoke wallet permissions, monitor transactions for unauthorized activity, and report the domain to relevant abuse contacts. Organizations are advised to update blocklists with the provided indicators and monitor for resurgence on alternative domains or IPs within the same hosting environment.