broker[.]trustedweb[.]pro

The domain broker.trustedweb.pro was observed targeting the Chase brand through a brand‑impersonation campaign that presents itself as a financial trading portal, as indicated by the page title "ZENITHMARKETS | Forex, Stocks, ETFs & Options Trading." The site resolved to the IP address 198.23.193.170, which belongs to HostPapa (AS36352) and is geolocated in the United States. No SSL certificate was present, and the domain lacked resolvable nameserver records (NS_NOT_FOUND), suggesting a rapidly provisioned or poorly configured hosting setup. Threat intelligence from VirusTotal recorded six detections out of ninety‑five scanning engines, reinforcing the suspicion of malicious activity. The domain was added to a single security blocklist and is currently blocked by the PhishDestroy mitigation service.

Independent scoring from Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of abuse. The infrastructure appears to be a disposable crypto‑drain platform, as the scam type is listed as "Crypto Scam," though the exact payload or monetary flow has not been captured. Because the site is presently offline, active probing is limited; however, the presence of a financial‑themed page title combined with Chase impersonation suggests that the operators intended to lure victims into providing credentials or transferring cryptocurrency under the guise of a trading service.

Defenders should continue to monitor the IP address 198.23.193.170 for any re‑use in future campaigns, enforce blocklisting of the domain across DNS and proxy layers, and incorporate the observed indicators into threat‑intel feeds. Additional investigation should focus on any residual DNS cache entries, potential WHOIS registration details, and correlation with other HostPapa‑hosted assets that may share similar patterns. Until the domain is definitively taken down, security teams are advised to treat any traffic to broker.trustedweb.