aiinvest[.]vip

This domain, aiinvest.vip, is identified as a high-risk brand impersonation threat designed to facilitate investment scams. Analysis indicates the site mimics legitimate financial trading platforms, offering fraudulent services in forex, commodities, stocks, indices, cryptocurrencies, gold, and oil under the fabricated brand name 'Likefire.' No specific drainer kit has been attributed to this domain at this time, but the infrastructure aligns with known investment fraud schemes targeting retail investors seeking high-yield opportunities. Infrastructure analysis reveals the following technical indicators: the domain is registered through Gname.com Pte. Ltd. and resolves to the IP address 188.114.97.3. It was created on June 15, 2024, and secured with a Let's Encrypt SSL certificate (identifier E8). VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. No entries were found in Google Safe Browsing at the time of this report. As of the latest assessment, aiinvest.vip remains active and continues to pose a significant risk to users. The domain's infrastructure, combined with its presence on multiple blocklists and detection by security vendors, underscores the likelihood of ongoing fraudulent activity. Users are advised to avoid interaction with this domain and any associated communications. Financial institutions and security teams should update filtering rules to block access to this domain and monitor for related phishing attempts or secondary infrastructure linked to this campaign.