fxtrade-portugal[.]com

This domain, fxtrade-portugal.com, is identified as a generic phishing infrastructure impersonating Fx Pro Portugal, a legitimate Forex and CFD trading platform. The site presents itself as a Portuguese trading portal, using the page title 'Fx Pro Portugal: Plataforma de Trading Forex e CFDs' to deceive users into believing it is an official or authorized service. No specific drainer kit signatures have been confirmed, but the presence of WordPress, PHP, and MySQL suggests a dynamically generated phishing framework designed to harvest credentials or financial data. Infrastructure analysis reveals the domain was registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.6.21, which is proxied through Cloudflare, obscuring the true hosting origin. Security vendor detection on VirusTotal stands at 4 out of 95, indicating limited but present recognition of malicious intent. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, further corroborating its fraudulent nature. Technologies detected include WordPress, jQuery, Yoast SEO, and Cloudflare Browser Insights, which are commonly exploited to enhance phishing site legitimacy and evade detection. As of the latest assessment, fxtrade-portugal.com has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the underlying infrastructure remains a residual risk, particularly if the threat actors retain control of the domain registration or associated IP space. Users who interacted with the site prior to its takedown may still be vulnerable to follow-up attacks, including credential stuffing or targeted phishing campaigns. Organizations are advised to monitor for related domains registered under the same registrar and to block the IP 104.21.6.21 at the perimeter. End-users should verify the authenticity of trading platforms through official channels and enable multi-factor authentication to mitigate account compromise risks.