fluidio[.]trade

The domain fluidio.trade has been identified as a high‑risk generic phishing infrastructure. Its threat classification is recorded as generic_phishing, and the operational status is listed as active as of the report date, 12 July 2026. Infrastructure analysis shows the domain was registered on 23 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is delegated to the Cloudflare nameservers brit.ns.cloudflare.com and felipe.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which is hosted by Cloudflare, Inc. in Canada. The web service presents a TLS certificate issued by Let’s Encrypt (E8) and returns HTTP 403 for direct requests. Detection telemetry indicates that three of ninety‑five VirusTotal scanners have flagged the domain, and one AlienVault OTX pulse references it. The domain appears on a single public blocklist and has a Gridinsoft trust score of 0 / 100, confirming a lack of reputational confidence. PhishDestroy has already added the domain to its block list. Publicly available content has not been examined, so the precise phishing lure, credential‑capture mechanisms, or targeted brand remain unknown. Absence of a page‑level analysis limits attribution of the campaign’s specific victim profile, but the generic phishing label suggests a broad credential‑stealing intent. Defenders should immediately block fluidio.trade at DNS and proxy layers, and consider blacklisting the associated IP 188.114.97.3. Continuous monitoring of Cloudflare edge nodes for similar patterns is advised. Updating intrusion‑detection signatures and threat‑intel feeds with the observed indicators will help mitigate further exploitation.