firmtradex[.]icu

firmtradex.icu was registered through Global Domain Group LLC on July 08, 2025 and resolves to the IP address 198.12.66.123, which is hosted in the United States under ASN 36352 (HostPapa). The domain is delegated to the name servers ns1.host-forest.com and ns2.host-forest.com and does not present an SSL/TLS certificate, indicating that any web traffic would be delivered over plain HTTP. The site title returned by the HTTP response is “Home”, and the domain is classified as a brand‑impersonation campaign targeting the brand “across”. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy has listed it as blocked. VirusTotal analysis shows that 12 out of 95 scanned security vendors have identified the domain as malicious, confirming its presence on at least one external blocklist.

The Gridinsoft trust score is 0 / 100, reinforcing the low credibility of the host. Analysis of the available infrastructure indicates that the attacker leveraged a low‑cost hosting provider (HostPapa) and public name‑server infrastructure, which is typical for short‑lived phishing operations. The lack of TLS and the generic page title suggest minimal investment in page design. The domain’s current status is offline, but the historical evidence of detection and blocklisting demonstrates that it was actively used before takedown.

Defenders should continue to enforce blocklisting of the IP 198.12.66.123 and the domain firmtradex.icu at perimeter defenses, DNS filters, and endpoint protection solutions. Monitoring for any re‑registration of the same name or similar patterns on the same hosting provider is advisable. Because the brand being impersonated is “across”, any communications referencing that brand should be scrutinized for potential phishing attempts originating from related infrastructure. The lack of an SSL certificate and the simple “Home” title provide additional indicators for automated detection rules.