redfordbitspirex-ai[.]net

This domain, redfordbitspirex-ai.net, is identified as a brand impersonation threat specifically targeting users through an AI-driven crypto investment scam. The page title, 'Redford Bitspirex – AI crypto trading platform for the United Kingdom 2026,' explicitly markets a fraudulent financial service, leveraging artificial intelligence as a lure to deceive victims into depositing cryptocurrency. No drainer kit signatures have been confirmed, but the domain mimics legitimate trading platforms to facilitate unauthorized fund transfers under the guise of automated trading services. Analysis indicates the domain was registered on February 21, 2026, through Sav.com, LLC, and resolves to the IP address 172.67.148.230, hosted on Cloudflare’s infrastructure (AS13335). VirusTotal reports 10 out of 95 security vendors flagging this domain as malicious, while it appears on three independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy. Google Safe Browsing (GSB) has not yet classified this domain, though it is actively blocked by at least three security providers, including PhishDestroy, MetaMask, and SEAL. The domain is currently offline, likely due to takedown efforts or infrastructure suspension. However, the risk remains elevated as threat actors may re-establish the campaign under a new domain or IP. Users who interacted with this domain should revoke any connected wallet permissions, monitor for unauthorized transactions, and report the incident to relevant financial and cybersecurity authorities. Organizations should update blocklists to include this domain and its associated IP to prevent further exposure.