tradestations[.]info

This domain, tradestations.info, is identified as a high-risk cryptocurrency phishing resource targeting users of financial trading platforms. Analysis indicates the site impersonates the legitimate Tradestation brand, likely deploying credential-harvesting or wallet-draining scripts to exfiltrate sensitive user data, including private keys and login credentials. The absence of an SSL certificate further suggests a disregard for basic security measures, increasing the likelihood of successful exploitation by threat actors. Infrastructure analysis reveals the domain was registered on March 4, 2026, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with malicious registrations. It resolves to the IP address 198.251.88.6, hosted under AS53667 (FranTech Solutions), a network provider commonly linked to bulletproof hosting services. Detection metrics show 12 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, and is currently not listed in Google Safe Browsing (GSB) databases. The page title, 'Tradestations,' directly mirrors the branding of the legitimate financial platform, reinforcing the phishing intent. As of the latest assessment, tradestations.info has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the risk of re-emergence remains high, given the domain's recent creation date and the persistent nature of cryptocurrency phishing campaigns. Users who interacted with the domain prior to its takedown are advised to revoke any connected wallet permissions, rotate credentials for associated financial accounts, and monitor for unauthorized transactions. Organizations should update internal blocklists to include the domain and its resolving IP address to prevent future access attempts.