obais[.]cc

This domain, obais.cc, is actively flagged as an investment scam platform targeting financial markets, including forex, commodities, stocks, indices, cryptocurrencies, gold, and oil. Registered on May 1, 2026, through Gname.com Pte. Ltd., the domain resolves to IP address 104.21.28.239, hosted on Cloudflare's infrastructure (AS13335). The page title explicitly advertises itself as a 'One-Stop Global Investment Platform,' aligning with known patterns of fraudulent investment schemes. Analysis of its infrastructure reveals the use of Cloudflare nameservers (nova.ns.cloudflare.com and rick.ns.cloudflare.com) and a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. The domain is blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. Twelve of ninety-one security vendors on VirusTotal have flagged this domain as malicious, and it has been referenced in two AlienVault OTX threat intelligence pulses, indicating confirmed malicious activity. Defenders should treat this domain as high-risk and prioritize blocking or monitoring any connections to it. While the exact content and functionality of the site remain unanalyzed, the combination of infrastructure indicators, blocklist presence, and threat intelligence confirms its malicious intent. No legitimate use case is identified, and further investigation into associated accounts or infrastructure is recommended.