redlighttherapy[.]meme

This domain, redlighttherapy.meme, is actively serving a phishing page targeting users of AI-powered trading platforms. Analysis indicates the site presents itself as 'Agental — AI-Powered Trading Agents,' a title likely chosen to exploit interest in automated financial tools. The domain was registered on March 6, 2026, through GoDaddy.com, LLC, and currently resolves to Cloudflare IP 188.114.97.3 under AS13335. A 301 HTTP redirect is in place, suggesting the site may funnel visitors to a secondary malicious endpoint not yet identified in available telemetry. Infrastructure analysis reveals Cloudflare nameservers (johnathan.ns.cloudflare.com and tina.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E7), both commonly observed in phishing operations due to their low-cost and high-availability nature. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and is flagged by 2 of 95 security vendors on VirusTotal. While this detection rate is modest, it aligns with the early stages of a phishing campaign where evasion techniques may still be in effect. What remains uncertain is the specific payload or credential-harvesting mechanism employed, as the 301 redirect obscures the final destination. The use of a .meme top-level domain may be an attempt to blend in with low-reputation or novelty sites, potentially delaying detection. Defenders should treat this domain as high-risk and prioritize blocking at the DNS or proxy level. Network logs should be reviewed for connections to 188.114.97.3 or related Cloudflare IPs, particularly in contexts involving financial or trading-related user activity. No legitimate association with AI trading platforms has been established for this domain.