aladdintradingsignal[.]com

The domain aladdintradingsignal.com is currently active and was registered on April 27, 2026 through Ultahost, Inc. The site returns HTTP 200 responses and presents a page title of "Aladdin Trading Signal". An analysis of the TLS handshake shows a Let’s Encrypt R12 certificate, confirming the use of a free SSL provider. The domain resolves to IP address 159.100.6.19, which geolocates to Germany and is associated with the same hosting provider, Ultahost.

Infrastructure inspection reveals that the IP host has been flagged by multiple security services. VirusTotal reports a single positive detection out of 95 scanning engines, and the Gridinsoft trust score is 0 out of 100, indicating a lack of trust. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. It is also referenced in a single AlienVault OTX pulse, suggesting limited but confirmed exposure within threat‑sharing communities.

The limited detection footprint—one vendor flag, one blocklist entry, and one OTX pulse—implies that the phishing campaign is either newly deployed or operating with a low profile to avoid broader detection. The use of a generic page title and a free SSL certificate is consistent with typical credential‑harvesting sites that aim to appear legitimate while minimizing operational costs. No additional payloads, such as malware binaries or credential‑stealing scripts, have been publicly disclosed, leaving the exact phishing workflow uncertain.

Defenders should prioritize blocking the domain and its resolved IP address at perimeter defenses and DNS filtering layers. Continuous monitoring of the host for changes in response codes, content, or additional security detections is recommended. Organizations should also watch for any related indicators that may emerge in threat‑intel feeds, particularly new OTX pulses or blocklist entries, and consider sinkholing the IP to disrupt potential victim interaction.