futuremarkets[.]top

The domain futuremarkets.top was registered through Dynadot LLC on 26 January 2025. It resolves to the IPv4 address 192.3.141.252, which is hosted by HostPapa (AS36352) in the United States. The authoritative name servers are ns1.anitahost.com and ns2.anitahost.com. No TLS certificate is presented, meaning the site serves only HTTP traffic. The observed page title is “Tesla Shares Holders – Home”, indicating an attempt to lure investors or shareholders, while the threat metadata classifies the campaign as a brand‑impersonation targeting “across”. The exact brand being spoofed is not confirmed in the available data, creating uncertainty about the intended victim set.

Technical fingerprinting shows the server runs Apache HTTP Server with PHP, and the front‑end loads jQuery, jQuery UI, Google Tag Manager, Google Analytics and Contentsquare scripts. These libraries are commonly used in phishing kits to track victims and deliver malicious payloads. Reputation services rate the domain extremely low: Scamadviser 1/100 and Gridinsoft 0/100. VirusTotal analysis reports that three of ninety‑five AV engines flagged the domain, confirming malicious intent. The domain appears on one public blocklist and is actively blocked by the PhishDestroy sinkhole, which has taken the site offline.

Despite the offline status, the infrastructure—particularly the hosting IP and name‑server pair—remains reusable for future campaigns. Defenders should continue to block 192.3.141.252 at network perimeter, add futuremarkets.top to URL filtering and DNS sinkhole lists, and monitor the associated name servers for new domains. Given the lack of TLS, any HTTP request to the domain can be intercepted or redirected, so enforcing HTTPS‑only policies will not mitigate this particular threat but will reduce exposure to similar campaigns. Continuous observation of the HostPapa AS36352 range for newly‑registered domains with similar naming patterns is advised.