pimcoai[.]net

On 23 July 2026 security analysts observed that the domain pimcoai.net was created on 21 February 2026 and resolved to the IP address 172.67.145.105, which is part of Cloudflare’s AS13335 network located in the United States. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare nameservers alina.ns.cloudflare.com and darwin.ns.cloudflare.com. No SSL certificate was detected, indicating that the site operated without HTTPS encryption. The page title returned by the server reads "Pimco - Oficiální platforma | AI‑Trading 2025 | Více než 10 000 hodnocení", which bears no direct reference to the claimed brand. Nevertheless, the intelligence categorizes the site as a brand‑impersonation campaign targeting Binance, a cryptocurrency exchange, and labels the scam type as brand impersonation.

Threat‑intelligence aggregators have recorded the domain on three security blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion. AlienVault OTX lists the domain in a single pulse, further corroborating its malicious use.

The current operational status is offline, which suggests the site has been taken down or is no longer reachable. Because the domain resolves to a shared Cloudflare IP, attribution to a specific operator is limited. Defenders should continue to monitor the IP address and associated Cloudflare nameservers for any re‑use, enforce blocklist updates in web filtering solutions, and add the domain to internal deny lists. Additional investigation of the page content, if any, and correlation with other Binance‑related phishing indicators is recommended to assess whether the campaign has shifted to new infrastructure.