claude-tradeapp[.]com

Analysis of claude-tradeapp.com indicates a confirmed phishing domain targeting users with a trading education pretext. The domain was registered on May 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP 104.21.33.7, hosted on Cloudflare's infrastructure (AS13335). The page title, 'Claude Trade - Trading Education,' suggests an attempt to lure victims under the guise of financial education or trading services. Infrastructure review reveals Cloudflare nameservers (damon.ns.cloudflare.com, davina.ns.cloudflare.com) and an active Let's Encrypt SSL certificate (E7), which may be leveraged to appear legitimate. The domain is flagged by one security blocklist and has been blocked by PhishDestroy. VirusTotal detections stand at 5 of 91 vendors, though the specific nature of these detections remains unconfirmed. Technologies detected include Snowplow Analytics and Cloudflare Browser Insights, which may be used for tracking user interactions or optimizing the phishing workflow. The domain remains active as of July 12, 2026, returning an HTTP 200 status. Defenders should treat this domain as high-risk, particularly in environments where financial or trading-related content is accessed. No evidence of a specific brand impersonation beyond the page title is present, and the exact phishing mechanics (e.g., credential harvesting, malware distribution) are not yet analyzed. Network-level blocking is recommended pending further investigation.