selimvalexor[.]live

Analysis of selimvalexor.live confirms its classification as a high-risk phishing domain targeting users of AI-assisted trading platforms. Registered on May 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains active and resolves to IP address 172.67.147.87, hosted behind Cloudflare infrastructure. The site's page title, 'Selim Valexor | Official Platform for AI Assisted Trading,' explicitly positions itself as an official trading service, a common tactic to establish false legitimacy. Technical indicators support its malicious designation: the domain appears on two security blocklists (PhishDestroy and BLP-Malware) and is flagged by 14 of 95 security vendors in aggregated threat intelligence. AlienVault OTX records 16 pulses referencing this domain, further corroborating its involvement in phishing operations. The domain's trust score is 0/100, and it employs a Let's Encrypt SSL certificate, which while providing encryption, is frequently used by threat actors to appear legitimate. Detected technologies include Cloudflare, Unpkg, jsDelivr, jQuery, and IPinfo, suggesting the use of third-party content delivery and geolocation services to enhance functionality and evade detection. The presence of HTTP/3 and Cloudflare Browser Insights may indicate attempts to optimize performance and track user interactions. Defenders should treat this domain as confirmed malicious. Recommended actions include blocking the domain and IP at network perimeter controls, alerting users to the AI trading scam theme, and monitoring for related domains registered through the same registrar or resolving to the same IP. The exact content and functionality of the site remain unanalyzed, but the infrastructure and intelligence align with active phishing operations.