drift-trade[.]app

Analysis of drift-trade.app indicates a brand impersonation campaign targeting Drift, active since domain registration on February 21, 2026. The domain is currently offline, though it previously resolved to 35.157.26.135, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. No SSL certificate was detected, increasing the likelihood of interception or manipulation of unencrypted traffic. The page title 'Drift - Portfolio' suggests an attempt to mimic legitimate Drift portfolio or trading interfaces, though the exact content and functionality remain unanalyzed.

Defenders should note that two security blocklists—PhishDestroy and ScamSniffer—have flagged this domain, and four of 93 security vendors on VirusTotal detected it as malicious. The domain uses nameservers dns1.p02.nsone.net through dns4.p02.nsone.net, which may assist in tracking related infrastructure. While the site is no longer accessible, historical DNS records and hosting details should be preserved for forensic correlation.

Organizations should monitor for internal access attempts to this domain and assess whether credentials or sensitive data may have been exposed prior to takedown. No evidence of a specific phishing kit or payload delivery is available, limiting further attribution. The elevated risk classification reflects the confirmed brand impersonation and detection by multiple security vendors, though the scope of compromise remains unclear.