cannarinvest[.]pro

Analysis of the domain cannarinvest.pro indicates that it was registered on February 21, 2026 through HOSTINGER operations, UAB. The site is presently taken offline, and its HTTP status reflects an unavailable service. DNS resolution points to the IPv4 address 198.12.66.123, which is hosted in the United States under ASN 36352 owned by HostPapa. The domain’s authoritative nameservers are ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com.

TLS negotiation presents a Let’s Encrypt R13 certificate, confirming the presence of HTTPS but offering no additional trust. The page title returned from the now‑inactive site is “Welcome - Cannar Invests”, matching the reported scam type of an investment‑related phishing campaign. A technology fingerprint shows the use of Bootstrap, LiteSpeed web server, jQuery, Slick carousel, Smartsupp live‑chat, GetButton widget, and HTTP/3 support. Threat intelligence from PhishDestroy has already blocked the domain, and it appears on one external security blocklist.

VirusTotal scanning recorded a single positive detection out of 93 vendors, reinforcing the malicious classification. No further public intelligence such as OTX or Safe Browsing entries is available for this domain. Given the confirmed infrastructure, the observed TLS certificate, and the single vendor flag, defenders should add cannarinvest.pro to local DNS or proxy blocklists, monitor the associated IP 198.12.66.123 for any resurgence, and ensure that any outbound traffic to the listed nameservers is inspected. Continuous re‑evaluation is advised in case the site reappears or additional indicators emerge.