pagi-inv[.]com

Analysis of the domain pagi-inv.com, created on January 09, 2026 and hosted on an OVH infrastructure (IP 57.128.229.28, Poland), shows a high‑risk phishing operation that remains active as of the report date, July 28, 2026. The domain resolves to a single IPv4 address owned by OVH Sp. z o. o and is served over HTTPS using a Let’s Encrypt certificate (YR2), indicating a valid TLS handshake but providing no indication of legitimacy.

Registrant information lists OwnRegistrar, Inc. as the registrar, while the authoritative name servers are ns1.symbolhost.com through ns4.symbolhost.com, a configuration frequently observed in malicious campaigns. Threat intelligence sources have recorded the domain in one AlienVault OTX pulse and it appears on three external blocklists. Protective services such as PhishDestroy, MetaMask, and SEAL have already blocked the domain, demonstrating that at least some security layers recognize its malicious nature. VirusTotal analysis shows that 1 of 91 security vendors flagged the domain, reinforcing the suspicion despite a low overall detection count.

The available evidence does not include a page title, brand targeting, or content snapshots, so the precise phishing template employed cannot be confirmed at this time. Defenders should add pagi-inv.com and its resolving IP 57.128.229.28 to perimeter blocklists, enforce DNS sinkholing for the associated name servers, and monitor for any outbound traffic to the OVOV network. Continuous re‑scanning of the URL through multi‑engine services is advised to capture any future changes in detection scores. Given the high risk rating and active status, immediate preventive controls are recommended to mitigate credential harvesting or related abuse.