elitactvfrxtde[.]com

The domain elitactvfrxtde.com is currently active and has been identified as a high‑risk brand‑impersonation site targeting Google users. Registration data shows it was created on March 23, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com, and the authoritative nameservers are ns1.shockhosting.com and ns2.shockhosting.com. The domain resolves to IP address 209.182.224.42, which belongs to AS395092 (Shock Hosting LLC) located in the United States. An SSL certificate issued by Let's Encrypt (R12) is present, and HTTP requests receive a 302 redirect response, indicating a possible URL forwarding mechanism. The page title returned by the server is "Welcome to our Site | Elite Active Fx Trade," and the site loads a range of front‑end libraries including particles.js, YouTube embeds, Bootstrap, LiteSpeed, Smartsupp, Slick, jQuery UI, and jQuery, suggesting a fairly complex web stack.

Threat intelligence indicates that the site is being used for a tech‑support scam that pretends to represent Google, a tactic often employed to trick victims into providing credentials or remote access. The domain has been blocked by the PhishDestroy feed and appears on one additional security blocklist, confirming its malicious reputation. VirusTotal analysis shows that 2 of 95 scanning engines have flagged the domain, reinforcing the suspicion of malicious intent. The Scamadviser trust score is 1 out of 100, reflecting an extremely low level of trust.

MX records are limited to a single entry with priority 0 pointing to elitactvfrxtde.com, which may be used for spoofed email communications. No safe‑browsing or OTX entries are available for this domain, leaving those vectors unverified. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies, and monitor for any outbound connections to the associated IP address.