cityindextrading[.]com

Analysis indicates that cityindextrading.com is an active phishing domain targeting financial trading platforms, specifically those associated with forex or CFD trading. Registered on March 5, 2026, through Ultahost, Inc., the domain currently resolves to the IP address 192.142.10.5. Infrastructure review shows it uses nameservers ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com, consistent with the registrar’s hosting environment. As of July 23, 2026, the domain appears on at least one security blocklist, with PhishDestroy marking it as malicious.

VirusTotal data shows that 3 out of 91 security vendors have flagged the domain, though the specific detection labels and methodologies are not provided. No evidence from Google Safe Browsing, AlienVault OTX, or other threat intelligence platforms is currently available in the supplied data. The domain remains active, and while the exact content of the site has not been analyzed, the combination of a trading-related name, recent registration, and detection by security vendors suggests it is likely designed to harvest credentials or financial information from users under the guise of a legitimate trading service.

Defenders should treat this domain as high-risk and consider blocking it at the DNS or proxy level. Organizations operating in the financial or trading sectors are advised to monitor for references to this domain in logs or user reports and to educate users about the risks of interacting with unverified trading platforms. Further analysis, including SSL certificate inspection, HTTP response headers, and page content review, would be necessary to confirm the exact phishing kit or brand being impersonated.