apextrader[.]xyz

The domain apextrader.xyz is currently active and has been classified as a generic_phishing site with a high risk rating. The page title returned by the server is “Home”, and the site responds with HTTP status code 200. Initial analysis indicates that the domain was registered on February 21, 2026 through the registrar Spaceship, Inc., and it remains unresolved in public threat feeds beyond a single blocklist entry. Infrastructure analysis shows that apextrader.xyz resolves to the IPv4 address 148.72.153.160, which is hosted in the United States and assigned to autonomous system AS30083 operated by velia.net. The domain uses the nameservers launch1.spaceship.net and launch2.spaceship.net, and presents a Sectigo Public Server Authentication CA DV E36 TLS certificate. The site is reachable over HTTPS and returns a valid certificate chain. Reputation services provide limited but consistent signals of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, indicating a highly untrusted host. VirusTotal reports that 3 out of 95 scanned security vendors have flagged the domain, and the domain appears on one security blocklist. The anti‑phishing service PhishDestroy has also listed apextrader.xyz as blocked. No additional content analysis is available, so the specific phishing payload or credential‑harvesting mechanisms remain unverified. Defenders should prioritize immediate blocking of apextrader.xyz at DNS and proxy layers, and consider adding the associated IP address 148.72.153.160 to network‑level deny lists. Continuous monitoring of the AS30083 range is advised, as the operator may reuse the same infrastructure for related campaigns. Updating intrusion‑detection signatures to flag the observed TLS certificate issuer and the Spaceship, Inc. nameserver pattern can further reduce exposure. Incident response teams should remain alert for any traffic matching the domain or its hosting attributes.