visionlexiproxp[.]com

This domain, visionlexiproxp.com, is flagged as a phishing infrastructure impersonating a professional trading platform under the fabricated brand "Vision Lexipro Xp." Analysis indicates the threat type is brand impersonation with likely cryptocurrency fraud objectives, targeting users through deceptive marketing language in the page title, "Entre nos mercados como um profissional." No direct evidence of a cryptocurrency drainer kit was identified, though the combination of WordPress, jQuery Migrate, and particles.js suggests a templated phishing framework designed for rapid deployment and scalability. Infrastructure analysis reveals multiple concrete technical indicators. The domain resolves to IP address 104.21.75.74 and was registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com. VirusTotal detection shows 10 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice among threat actors to lend superficial legitimacy. Technologies detected include WordPress, MySQL, PHP, Bootstrap, and several JavaScript libraries, indicating a full-stack web application designed to mimic legitimate trading platforms. The domain is currently offline, having been taken down following detection by automated phishing response systems. Despite its inactive status, residual risk remains elevated due to the domain's recent registration date, which predates its actual use by several years—a tactic often employed to bypass age-based reputation filters. Users are advised to treat any prior interaction with visionlexiproxp.com as compromised, particularly if credentials or cryptocurrency wallet details were entered. Financial institutions and security teams should monitor for related indicators, including the IP address and registrar details, as this infrastructure may be repurposed or reactivated under a different domain.