app[.]xtrading[.]exchange

PhishDestroy identifies app.xtrading.exchange as a live credential-harvesting phishing domain masquerading as a legitimate trading platform to steal financial account credentials. This domain resolves to IP 216.150.1.65 and uses a Let’s Encrypt SSL certificate to appear trusted while hosting a spoofed login page that captures usernames and passwords. The low detection rate (1/95 on VirusTotal) suggests it remains under the radar of most scanners, increasing the risk to visitors who may unwittingly submit sensitive data. Investigators found no evidence of blocklist entries at the time of analysis, indicating the domain is newly active and still evading blacklists. This domain was registered recently and has not yet been widely flagged, making it a stealth threat to users who encounter it via email, social media, or search engine results. The combination of a fresh domain, low detection, and a benign SSL certificate creates a deceptive facade that lures victims into entering their financial credentials. If you visited app.xtrading.exchange, cease use immediately and change passwords on all financial accounts. Scan all devices for malware and report the domain to your bank and relevant cybercrime units. Avoid clicking any links or providing data to this site, and warn others who may have encountered it. Block the IP 216.150.1.65 and the domain at your network perimeter to prevent further access.