VirusTotal
13 / 89
ReportInterpretation & limits
Engine detections from this stored analysis. Vendors and collection times may differ from other sources.
Domain security and threat intelligence
tradexium.online
“Tradexium | CFD Trading — Trading on Stocks, Gold, Oil, Indices”
Threat verdict
CriticalDomain Appeal
Assessment sources
Assessment based on the stored source evidence below. Review sources →
Availability
Last known active
Latest stored reachability observation
Observed · HTTP probe
Risk signals
VirusTotal detections: 13/89
Spamhaus DBL: DBL_SPAM
Brand impersonation: Genericscam
- Registrar
- Ultahost
- Resolved IP
- 159.100.6.19
- Registered
- Mar 14, 2026
ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@first-colo.net.
The latest stored availability evidence still shows the domain reachable; 7 months has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
Elapsed since first report
7 months
Reports sent
1
Latest case ID
PD-20260318-E45AF7
Current status
HTTP 301 at latest stored check
Report overview
The site tradexium.online was configured as a fake exchange for CFD trading, claiming to offer trading on stocks, gold, oil, and indices under the brand "Tradex
The detailed PhishDestroy AI analysis below remains in English to preserve the original forensic record.
Additional indicators at a glance
Spamhaus DBL
DBL_SPAM
VirusTotal
13 det.
OTX references
URLScan
TLS Certificate
Expired or unverified
Age
7 mo
Observed status
Last known active 301
DestroyList
Listed
Reports Sent
1
Source evidence
10 sourcesThese are dated observations, not a live safety check. No flag, a stored capture, or a completed analysis does not establish that a site is safe.
URLScan verdict
malicious
ReportInterpretation & limits
This is the recorded automated analysis. Completion alone is not a safety verdict.
Spamhaus DBL
DBL_SPAM
Interpretation & limits
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
URLQuery
Report stored; detailed verdict not recorded
Observation time not recorded
Report Interpretation & limits
Alerts refer to the preserved scan. They do not describe the current state of the site.
PhishStats
checked — no match recorded
Interpretation & limits
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
OTX
25 community references
ReportInterpretation & limits
Community publication references, not a vendor verdict or evidence of a common operator.
CF Radar
provider verdict: clean
Observation time not recorded
Report Interpretation & limits
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
URLScan capture
stored report
Observation time not recorded
Report Interpretation & limits
A preserved page image documents what the collector received; a capture is not a safety verdict.
DNS blocks
14 checked — no blocks
Observation time not recorded
Interpretation & limits
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
Google Safe Browsing
Checked; no threat flag recorded
ReportInterpretation & limits
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
Evidence Summary
Stored narrative · generated . Provider checks below retain their own observation dates.
The site tradexium.online was configured as a fake exchange for CFD trading, claiming to offer trading on stocks, gold, oil, and indices under the brand "Tradexium". The primary threat posed by this domain was operating as a fraudulent financial platform designed to deceive users into depositing funds for trading that would not be legitimate, leading to potential financial loss.
Technical evidence shows the domain was flagged by 6 out of 95 VirusTotal vendors and listed on 1 blocklist. It was registered with Ultahost, Inc., and hosted at IP address 159.100.6.19 in Germany under UltaHost Inc. The domain was created on 2026-03-14 and used a Let's Encrypt SSL certificate (R12). The nameservers were ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com. GridinSoft trust score was 0 out of 100, and the DOM risk score was 73.
As of the latest check, the domain status is SUSPENDED, indicating active mitigation. The risk level is high based on the low trust score, high risk score, and confirmed scam type.
Forensic Intelligence
Detection-evasion analysis
Cloaking and traffic-distribution check
Not observed
No cloaking was observed in the stored scan
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
- Stored cloaking flag
- Not observed
- Cloaking score
- 0/6
- Last cloaking scan
- Server header seen by scanner
LiteSpeed
Scanner note: redirect: raw=redirect_301; http=301; via=https_proxy; location=https://marketzgroup.es/; server=LiteSpeed
Live TDS fingerprint check
Seven Keitaro fingerprints plus a crawler-versus-browser comparison, run from the PhishDestroy scanner when this panel is open.
Waiting
Stored Capture · 2 captures
Domain details
Domain
URLScan Verdict
Malicious
score 100 Phishing report ↗
IP Reputation
abuse score 2/100 3 reports PhishingBad Web Bot checked Oct 12, 2026
OTX Tags
Registrar
Ultahost
(US)
(US)
RegistrationCreated Mar 14, 2026 (214d) — Expires Mar 14, 2027
HTTP Status301 Moved Permanently
Technical detailsProvenance & timestamps
First DetectedMar 18, 2026
DOM Analysis
Submitted URLhttps://tradexium.online/
Favicon Hash
Case ID
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accreditation is a contract, not a safety seal.
Verify ICANN fees
Read RAA §3.18
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Network & certificates
Stored technical evidenceNetwork & DNS
- Resolved IP
- 159.100.6.19
- Network ASN
- AS214036
- Organization
- UltaHost Inc
- Observed location
- Frankfurt am Main, DE
- Server header
- LiteSpeed
Nameservers 4
ns1.ultahost.comns2.ultahost.comns3.ultahost.comns4.ultahost.com
Location describes the IP network.
TLS certificate
- Issuer
- Let's Encrypt
- Valid from
- 2026-03-14 12:39:34
- Valid until
- 2026-06-12 12:39:33
- Hostname coverage
- Certificate hostname mismatch
- Validity
- Stored certificate expired
- Collection time
- 2026-03-23 23:10:48 UTC
- Collection source
- PhishDestroy collector
Certificate fingerprint
84f64f679e98015f12927f3f3a9fc4d01785a13b0ecf38b5fde41280cab42fdeCertificate names · 8 SANs
autodiscover.tradexium.onlinecpanel.tradexium.onlinecpcalendars.tradexium.onlinecpcontacts.tradexium.onlinemail.tradexium.onlinewebdisk.tradexium.onlinewebmail.tradexium.onlinewww.tradexium.online
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest Classified Outcome 2026-10-14 10:32:46 UTC
Primary outcome
Redirecting
reason: HTTP redirect observed 80% confidence
Attribution
source: Current Http Probe
Evidence layers
Availability: Redirecting
Content: Unknown
DNS: Resolved
Registration: Unknown
Latest HTTP observation
Redirecting HTTP redirect observed 80% 2026-10-14 10:32:46 UTC
RDAP registration
Unknown
Observed timeline
last reachable: 2026-10-14 10:32:46 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Report This Domain
Submit evidence & help protect others
VirusTotal Analysis
13 / 89 security vendors flagged this domain
View on VT
Last analyzed Previous stored snapshot: 12 detections
alphaMountain.ai
BitDefender
Chong Lua Dao
CyRadar
ESET
Forcepoint ThreatSeeker
Fortinet
G-Data
Gridinsoft
Lionic
SOCRadar
Sophos
VIPRE
Site Performance Analysis
Google PageSpeed Insights — mobile performance audit of tradexium.online · checked Apr 10, 2026
28
Poor
Performance
FCP
4.05s
First Contentful Paint
LCP
41.81s
Largest Contentful Paint
CLS
0.641
Cumulative Layout Shift
TBT
269ms
Total Blocking Time
SI
15.66s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
Threat Response Pipeline
Discovery
Analysis
Notifications
Monitoring
12 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
Threat Ingested
tradexium.online detected and queued for full analysis
Spamhaus DBL
Spamhaus DBL recorded DBL_SPAM
URLScan.io Capture
Stored URLScan report with capture artifacts
URLScan Verdict
URLScan returned a malicious verdict · score 100
Cloudflare Radar Report
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
VirusTotal
13/89 recorded on VirusTotal
OTX Community References
25 community publication references on AlienVault OTX. References are not vendor verdicts and are excluded from the evidence score.
Brand Impersonation
Impersonation of Genericscam
Forensic Evidence Collected
Stored evidence from URLScan.io, URLQuery, stored screenshot
Technical Analysis Recorded
The report contains stored technology or forensic-analysis results.
Sent Report Recorded
Stored outgoing record associated with registrar Ultahost, Inc., 2 abuse contacts
abuse@first-colo.netu-abuse@ultahost.com
DestroyList Published
Listed in the public PhishDestroy/DestroyList repository
Monitoring Continues
The domain remains reachable or access-restricted; future checks may update this observation.
How we investigate & report
Public scans, evidence and abuse channels
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups
urlscan.io
Screenshot · DOM · HTTP
Capture the rendered page, requests and visible infrastructure.
VirusTotal
Multi-engine verdicts
Compare the available engine results and retain the analysis timestamp.
Google Safe Browsing
Transparency Report
Check whether Google currently lists the URL as unsafe.
Cloudflare Radar
DNS · certificates · categories
Inspect a public scan and its recorded network and classification data.
AlienVault OTX
Threat-intelligence pulses
Look for indicator references and related community intelligence.
Wayback Machine
Historical evidence
Compare archived captures and preserve historical context.
abuse.ch ThreatFox
IOC correlation
Look for matching indicators and associated threat records.
crt.sh
Certificate Transparency
Inspect certificate records and related hostnames.
DNS Security Filters
Quad9 · AdGuard · CleanBrowsing
Compare security resolver responses and record observed blocking.
Web-Check
Surface inspection
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels
- Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
- Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
- Send the report. Keep outgoing report records and recipient information when available.
- Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
GoogleSafe Browsing↗
GoogleWeb Risk↗
MicrosoftSmartScreen↗
VirusTotalURL analysis↗
CloudflareRadar / abuse reporting↗
YandexSafe Browsing↗
URLScan.ioPublic scan↗
ESETSample / URL submission↗
BitdefenderURL submission↗
NortonSafe Web↗
SymantecSiteReview↗
AviraURL reporting↗
Avast / AVGURL reporting↗
KasperskyOpenTIP↗
Dr.WebOnline scanner↗
NetcraftAbuse reporting↗
PhishTankCommunity reporting↗
APWG eCXPhishing intelligence↗
PhishStatsPublic feed↗
Phish.ReportHosting abuse↗
SpamhausDomain reputation↗
PolySwarmMulti-engine analysis↗
CheckPhishURL scan↗
QutteraMalware scan↗
URLqueryBrowser analysis↗
Criminal IPAsset intelligence↗
CRDFThreat Center↗
ScamadviserReputation check↗
MyWOTCommunity reputation↗
Community reports
Reported by 1 community member, first seen Mar 18, 2026
- Stored reports
- 1
- Unique reported URLs
- 1
Accepted1
Evidence & External Reports
Security Analysis
Submitted Evidence Snapshot
Sent: Ledger records: 1
Case ID:
PD-20260318-E45AF7 Recipient: abuse@first-colo.net
PDF notice generated Notice text archived (1,167 chars)
Abuse notice text as sent to the provider
Policy Violations: Acceptable Use Policy (AUP): The domain tradexium.online is actively engaged in phishing activities, which constitute a direct violation of your AUP prohibiting illegal activities and fraud. Terms of Service (TOS): The use of this domain for deceptive practices breaches your TOS, which reserves the right to suspend or terminate services for violations related to fraud and phishing. Applicable Laws (Unknown): Computer Fraud and Abuse Act (CFAA): This U.S. law prohibits unauthorized access and fraud in connection with computers and networks. Wire Fraud Statute (18 U.S.C. § 1343): This law criminalizes schemes to defraud or obtain money through false representations via electronic communications. CAN-SPAM Act (15 U.S.C. § 7701): This act regulates commercial email and prohibits misleading headers and deceptive subject lines, which are often used in phishing schemes. Regulatory Note: Failure to take immediate action against tradexium.online may expose your organization to liability under applicable laws and regulations, as well as potential sanctions from regulatory authorities. It is imperative to act swiftly to mitigate these risks.
OSINT & Intelligence
DNS & Network
SEO & Domain
Deep Analysis
Were You Affected by This Site?
6 evidence signal groups linked
1 reports recorded
Last known active
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Action Fraud
Report fraud and cybercrime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
97-country directory
Template-based draft · optional AI wording assistance requires separate consent
Template-based draft • optional AI wording assistance requires separate consent · Review and submit it yourself
Related Infrastructure & Reports
- Direct link Shares a registration or an identical phishing kit.
- Supporting signal Shares infrastructure or a target brand; not proof of one operator.
- Discovery only Listed for navigation; no shared attribute with this host.
Each lane is one reason a domain is linked to this host. Node size marks VirusTotal detections and dashed nodes are already offline. The full lists follow below.
Content matches 4
Same favicon hash or the same page title as this host.
Shared IP 159.100.6.19 6
Multiple reports share this IP.
Genericscam impersonation 8
These domains also target Genericscam users. View all Genericscam threats →
Same registrar: Ultahost 6
Registered through the same registrar. A registrar serves millions of unrelated customers, so this groups reports rather than proving a link.
Recent threat reports 4
Recently added threat reports.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive