equatorialinvest[.]com

The domain equatorialinvest.com was registered on April 19 2026 through NameSilo, LLC. Within days it appeared on a security blocklist maintained by PhishDestroy, indicating that it is being used for malicious credential‑harvesting. The site’s HTML title is “Equatorial Invest”, matching the domain and suggesting a spoofed financial service. VirusTotal has recorded a single positive detection out of 95 scanned security vendors, which is consistent with early‑stage phishing deployments that often evade bulk scanners. Technical probing shows the site responds with an HTTP 302 redirect, a common pattern for phishing pages that forward victims to credential‑capture forms. The domain resolves to IP 163.61.188.2, an address geolocated to the United States and associated with the MIT network. The SSL certificate is issued by Let’s Encrypt (R12), providing a valid TLS chain that can lend the site an appearance of legitimacy. Nameservers are dns1.lytehosting.com through dns4.lytehosting.com, a set often observed in cheaply hosted malicious sites. Gridinsoft assigns the IP a trust score of 0 / 100, and AlienVault OTX lists the host in one threat‑intel pulse, reinforcing the malicious classification. While the current evidence points to a classic generic phishing campaign targeting investors, the low detection rate on VirusTotal and the single blocklist entry leave open the possibility of additional infrastructure that has not yet been indexed. Defenders should add equatorialinvest.com and its resolving IP 163.61.188.2 to network block lists, enforce URL filtering, and monitor for outbound connections to the LyteHosting nameservers. Users receiving unsolicited communications referencing “Equatorial Invest” should be warned to verify the sender and avoid entering credentials on the site.