oroviento[.]live

This domain is classified as an elevated-risk generic_phishing threat, specifically targeting users through a fraudulent AI-assisted trading platform. Analysis indicates the site was designed to deceive visitors into believing it is an official trading service, leveraging social engineering tactics to harvest credentials or financial information. Infrastructure analysis reveals multiple high-risk indicators. The domain oroviento.live resolves to IP address 188.114.97.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 27, 2026, an unusually future-dated registration suggestive of fraudulent activity. It is flagged by 8 out of 95 security vendors on VirusTotal, appears on one security blocklist, and holds a Gridinsoft trust score of 0/100. The site employed Let’s Encrypt SSL certification and utilized technologies including Unpkg, jsDelivr, jQuery, Cloudflare Browser Insights, and Cloudflare with HTTP/3 support, which are commonly abused to lend legitimacy to malicious operations. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address at the network perimeter. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window and monitor financial statements for unauthorized transactions. Organizations should conduct retrospective log analysis to identify any internal access attempts to oroviento.live, particularly from endpoints that may have bypassed existing security controls. Given the AI-assisted trading pretext, heightened scrutiny is warranted for any follow-up communications claiming affiliation with this domain, as secondary phishing attempts are likely.