standx[.]center

This domain, standx.center, is flagged for brand impersonation targeting the Signal messaging platform. Analysis indicates the site masquerades as a non-commercial trading education platform, titled 'StandX - Trading Education & Market Insights | Non-Commercial Platform,' to deceive users into engaging with fraudulent content. No direct evidence of a crypto drainer or credential harvesting kit was observed, though the site employs PHP, Materialize CSS, and jQuery CDN, alongside Cloudflare Browser Insights for analytics and performance tracking. The infrastructure leverages Cloudflare’s proxy services, obscuring the origin server and complicating attribution efforts. Technical indicators reveal the domain was registered on December 18, 2025, through HOSTINGER operations, UAB, a registrar frequently associated with newly established phishing infrastructure. The domain resolves to IP address 172.67.196.15, a Cloudflare-assigned address, further indicating the use of proxy services to conceal the true hosting environment. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, suggesting the campaign remains undetected by most security vendors. The domain appears on a single security blocklist, and AlienVault OTX records it in one threat intelligence pulse. The SSL certificate is issued by Google Trust Services, a common certificate authority for both legitimate and malicious domains, providing no definitive indication of intent. The domain is currently offline, likely due to takedown efforts or voluntary suspension by the registrar. Despite its inactive status, residual risk persists due to the domain’s recent registration and the potential for reactivation. Users who interacted with the site prior to its takedown should monitor for unauthorized access to accounts or financial transactions, particularly if credentials or personal information were submitted. Organizations are advised to update blocklists with the domain and associated IP address, while security teams should investigate related infrastructure for signs of broader campaign activity. Continuous monitoring of newly registered domains under the same registrar or resolving to similar Cloudflare IPs is recommended to preemptively identify emerging threats.