cmeglobtradetf[.]com

Analysis indicates that cmeglobtradetf.com is actively hosting a fraudulent exchange page. The site returns HTTP 200 and presents the title “CME”, suggesting an attempt to reference a well‑known market entity. Infrastructure fingerprints show the site is served by Nginx with HTTP/3 enabled, enforces HSTS, and runs a Vue.js front‑end. The TLS certificate is issued by Let’s Encrypt (YR1) and the domain resolves to 134.122.128.185, an address assigned to Rackip Consultancy Pte. Ltd. in Japan. Registration details reveal the domain was created on 7 January 2026 through Gname.com Pte. Ltd., and it uses four shared name servers (a.share‑dns.com, a1.share‑dns.com, b.share‑dns.net, b1.share‑dns.net). Threat‑intel feeds have marked the domain as high‑risk; it is listed on three security blocklists and has a Gridinsoft trust score of 0 / 100. Three of 91 VirusTotal scanners flag the site, and it is currently blocked by PhishDestroy, MetaMask and SEAL. The observed scam type is “Fake Exchange”, indicating that the site likely attempts to harvest credentials or funds by masquerading as a legitimate trading platform. While the page content has not been examined, the combination of a newly registered domain, low trust score, active blocklist listings, and the presence of HSTS and HTTP/3 suggest a deliberate effort to appear legitimate while evading detection. Defenders should block the domain at network perimeter, monitor DNS queries for the associated name servers, and add the IP address to threat‑intel feeds. Incident response teams should treat any credential submissions to this domain as compromised and advise users to change passwords and verify account activity with the genuine service.