richepatrimesse[.]live

The domain richepatrimesse.live is currently flagged as a high‑risk phishing site targeting users of AI‑assisted trading platforms. The page title presented by the server – “Riche Patrimesse | Plateforme officielle de trading assisté par IA” – explicitly mimics a legitimate financial service, indicating an intent to harvest credentials or financial information from visitors. The domain was registered on 15 May 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.97.3, which belongs to CloudFlare, Inc. in Canada. Both authoritative nameservers, hal.ns.cloudflare.com and jocelyn.ns.cloudflare.com, are CloudFlare‑provided, and the site serves traffic over HTTPS using a Let’s Encrypt certificate identified as “YE1”. The HTTP response code is 200, confirming that the page is actively delivering content. VirusTotal has recorded three detections out of ninety‑five scanning engines, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigns a trust score of 0 / 100, reflecting a classification of malicious. Additionally, AlienVault OTX lists the domain in one threat‑intelligence pulse, reinforcing its association with phishing activity. While the available data confirms the domain’s phishing purpose, no further infrastructure such as additional IPs, C2 servers, or payload samples have been observed, leaving the full scope of the campaign uncertain. Defenders should add the domain to deny‑list rules, monitor DNS queries for the associated CloudFlare nameservers, and enforce TLS inspection to capture the underlying page content. Continuous re‑evaluation is advised, as the active status and recent registration suggest the operation may evolve rapidly.