labtradelive[.]xyz

The domain labtradelive.xyz was registered on 26 October 2025 and is presently taken offline, displaying the HTTP page title "Account Suspended." Infrastructure analysis shows the domain resolves to the IPv4 address 195.26.87.207, which is allocated to AS43641 SOLLUTIUM EU Sp z.o.o. in the Netherlands. The authoritative name servers are ns1-ams.v-sys.org and ns2-ams.v-sys.org, and the registration was processed through NiceNIC International Group Co., Limited. No TLS certificate is presented for the host, indicating that any future service would be delivered over plain HTTP.

The domain has been listed on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, confirming that it has been identified as a malicious resource. VirusTotal scans reveal that four of ninety‑five anti‑malware engines flagged the domain, providing additional independent confirmation of its suspicious nature. The threat classification in the intelligence set is an "Account Takeover" scam, suggesting that the operator intends to lure victims into revealing credentials for the purpose of unauthorized account access. While the current offline status reduces immediate exposure, the infrastructure—particularly the dedicated IP address and persistent nameserver configuration—indicates that the actor could revive the site or spin up additional domains using the same hosting environment.

Defenders should therefore add labtradelive.xyz to internal deny lists, block traffic to 195.26.87.207 at the network perimeter, and monitor for any re‑registration or re‑activation of the domain. Email gateway filters and web proxies should be updated to reference the known blocklists (PhishDestroy, ScamSniffer) to prevent delivery of any future phishing messages that reference this host.