ashleycmadison[.]com[.]nivesttrade[.]com

The domain ashleycmadison.com.nivesttrade.com was registered on February 21, 2026 through Global Domain Group LLC and is currently taken offline. DNS resolution points to the IPv4 address 198.251.89.220, which belongs to AS53667 (FranTech Solutions) in the United States. The authoritative nameservers are ns27.asurahosting.com, ns27.my-control-panel.com, and ns28.asurahosting.com. An SSL certificate issued by Let’s Encrypt (R12) secures the site, indicating a valid TLS handshake was available when the domain was active.

Content analysis reveals a WordPress stack backed by MySQL and PHP, with front‑end components including Bootstrap, Slider Revolution, Modernizr, jQuery, and the LiteSpeed web server. The page title returned by the server is "Ashley Madison," confirming the site was intended to impersonate the Ashley Madison brand. VirusTotal reports a single detection out of 95 scanned security vendors, and the domain appears on one public blocklist, specifically PhishDestroy, which has already flagged it as malicious. No additional public threat intelligence sources such as OTX or Safe Browsing entries are referenced in the available data.

The limited detection footprint suggests the campaign was short‑lived or quickly mitigated, but the presence of a legitimate TLS certificate and a common web‑application stack indicates a level of operational sophistication. Defenders should continue to monitor the IP address 198.251.89.220 for any re‑use, enforce outbound filtering for the domain and its subdomains, and ensure that any internal references to Ashley Madison URLs are validated against known legitimate endpoints. Updating URL filtering and phishing‑protection rules to include this domain and its associated nameservers will help prevent future attempts that reuse the same infrastructure.