aitradingpost[.]site

The domain aitradingpost.site was registered on May 13, 2025 through Go Daddy, LLC and is currently taken offline. The site presented a page title of "Base" and was identified as impersonating the brand "base". Technical fingerprinting shows the server runs Nginx with HTTP/3 support, enforces HSTS, and serves a Vue.js front‑end. The SSL certificate is issued by Let’s Encrypt (R13).

DNS resolution points to IP address 27.124.30.41, which belongs to AS152194 (CTG Server Limited) and is geolocated in Hong Kong. The domain is delegated to GoDaddy’s default nameservers ns15.domaincontrol.com and ns16.domaincontrol.com. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 1/100, and the domain is listed on at least one public blocklist. PhishDestroy has actively blocked the domain, and VirusTotal reports that 14 of 95 scanned security vendors flagged the host as malicious.

The observed scam type is classified as Wallet/Seed Phishing, suggesting attempts to harvest cryptocurrency wallet credentials or seed phrases. Defenders should add the domain and its resolving IP to network blocklists, monitor the ASN for any re‑use of the IP range, and enforce strict outbound filtering for connections to untrusted certificate authorities. Incident response teams should also alert end‑users of the brand impersonation risk, instruct them to verify any communications claiming to originate from "base" through official channels, and consider sharing the indicator set with threat‑intel sharing platforms to improve community detection.