renvekstnor[.]live

PhishDestroy has identified renvekstnor.live as a generic phishing domain targeting users with a fraudulent AI-assisted trading platform. The site impersonates Ren Vekstnor, a legitimate brand in the trading space, and likely aims to steal login credentials or financial information from unsuspecting visitors. No specific drainer kit has been identified, but the site's design and purpose strongly suggest credential harvesting.

Technical indicators paint a clear picture of risk. VirusTotal shows a detection rate of only 1 out of 95 security vendors, meaning the vast majority of scanners fail to flag this threat. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains, and it resolves to IP address 188.114.96.3. Created on May 25, 2026, the domain is relatively new, which is common for phishing operations. It is listed on 1 security blocklist and is not currently flagged by Google Safe Browsing, though its SSL certificate from Let's Encrypt provides a false sense of security.

As of this analysis, the domain remains active and accessible. Users who have interacted with renvekstnor.live should change passwords for any accounts used on the site and monitor for unauthorized activity. PhishDestroy recommends blocking this domain immediately and verifying any communications claiming to be from Ren Vekstnor through official channels. The combination of low vendor detection and recent registration means the threat may persist undetected for some time.