orientinvest[.]ltd

On July 23, 2026 analysts reviewed the domain orientinvest.ltd, which was registered through Sav.com, LLC on February 21, 2026. The domain resolves to the IP address 173.0.59.2, an address owned by Wowrack.com (AS27323) and located in the United States. DNS resolution is provided by ns1.korrectserver.com and ns2.korrectserver.com. The site presented a simple page title matching the domain name and employed a stack that included particles.js, Bootstrap, LiteSpeed, Smartsupp, OWL Carousel, jQuery, Popper, and HTTP/3.

An SSL certificate issued by Let's Encrypt (R12) was in place at the time of capture. Threat‑intelligence feeds flagged the domain as an investment‑scam type of generic phishing. VirusTotal recorded 13 of 93 security vendors marking the domain as malicious, and the domain appears on a single security blocklist. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent.

The domain was subsequently taken offline and is currently listed as offline by monitoring services, with PhishDestroy confirming the block. While the domain is no longer active, the historical evidence suggests it was used to lure victims under the guise of investment opportunities. Defenders should continue to block the associated IP address, monitor for any re‑registration attempts, and ensure that outbound traffic to the identified nameservers is restricted. Ongoing vigilance is advised to detect any resurgence of the infrastructure, especially given the low trust score and multiple vendor detections that indicate a previously active malicious campaign.