optionsxpress-1105693[.]vip

This domain, optionsxpress-1105693.vip, is identified as a phishing site impersonating the legitimate brokerage platform Options Xpress. Analysis indicates the site presents a fraudulent login interface designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. The threat targets retail investors and financial account holders, aiming to gain unauthorized access to brokerage accounts for fraudulent transactions or identity theft. The page title 'Options Xpress' and visual design closely mimic the authentic service, increasing the likelihood of successful deception among unsuspecting users seeking legitimate trading platforms.

Infrastructure analysis reveals the domain was registered on January 20, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, indicating no established reputation. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, with PhishDestroy actively blocking it. The domain resolves to the IP address 34.94.84.231, which has been linked to other transient phishing infrastructure in recent months. The combination of recent registration, low detection but high-risk indicators, and targeted brand impersonation suggests a deliberate and short-lived campaign designed to evade detection while maximizing credential collection.

Users who visited optionsxpress-1105693.vip should immediately cease all interaction with the site and perform the following actions: reset passwords for any accounts accessed via the domain, enable multi-factor authentication on all financial platforms, and review recent transaction history for unauthorized activity. If financial credentials were entered, contact the legitimate brokerage immediately to report potential compromise and request account monitoring. Clear browser cache and cookies to remove any residual session data, and consider running a full antivirus scan to detect potential secondary infections. Monitor credit reports and financial statements for signs of identity theft or fraudulent transactions. Given the domain's recent creation and offline status, users should remain vigilant for similar phishing attempts using slight variations of the Options Xpress brand or other financial services.