bexlora[.]trade

This domain is flagged for hosting a phishing campaign targeting users of financial trading platforms under the guise of a legitimate trading terminal interface. Analysis indicates the threat type is credential harvesting with an elevated risk classification due to its targeted nature and active distribution methods. Infrastructure analysis reveals the domain bexlora.trade resolves to IP address 185.158.133.1 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. The domain appears on four security blocklists and is actively blocked by multiple browser-based protection systems. Detection metrics show 6 out of 95 security vendors flagging the domain on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The page title 'Bexlora Trading Terminal' directly impersonates financial trading software, and technical indicators confirm the use of Cloudflare with HSTS implementation. Mitigation requires immediate domain blacklisting in enterprise security systems and endpoint protection platforms. Network administrators should block the resolved IP address 185.158.133.1 at firewall level and monitor for any residual connections. Users should be advised to verify trading platform URLs through official documentation only, avoid entering credentials on untrusted interfaces, and report any suspicious login prompts to security teams. Credential reset procedures should be initiated for any accounts potentially exposed to this campaign.