presapexmarkets[.]com

This domain, presapexmarkets.com, is flagged as an elevated-risk phishing infrastructure specifically designed for credential harvesting targeting financial and cryptocurrency trading platforms. Analysis indicates the site impersonates legitimate trading services to deceive users into submitting login credentials, API keys, or wallet recovery phrases, which are then exfiltrated to attacker-controlled endpoints. The threat type aligns with patterns observed in fake trading platform scams, where brand impersonation and social engineering are leveraged to exploit victims under the guise of market access or investment opportunities. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 08, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 163.61.188.9 and has been flagged by 10 out of 95 security vendors on VirusTotal, with detections spanning generic phishing, brand impersonation, and malicious URL categories. The domain appears on at least one security blocklist and has been documented in four threat intelligence pulses on AlienVault OTX. Gridinsoft assigns a trust score of 1/100, further corroborating its malicious classification. Frontend technologies detected include PHP, YouTube embeds, Tailwind CSS, LiteSpeed, Alpine.js, Unpkg, Smartsupp, and jQuery CDN, suggesting a sophisticated but templated approach to mimic legitimate trading platforms. The page title 'Problem loading page' may indicate a failed deployment, takedown, or deliberate evasion tactic to avoid detection during active campaigns. Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP (163.61.188.9) across network security controls, including firewalls, DNS filters, and email gateways. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and registrar details (Global Domain Group LLC) into security information and event management (SIEM) systems to detect potential lateral movement or data exfiltration attempts. End users should be educated on recognizing fake trading platforms, particularly those using urgent calls-to-action (e.g., limited-time offers, account verification demands) or spoofed branding. Multi-factor authentication (MFA) should be enforced for all financial and cryptocurrency accounts to mitigate credential theft risks. Incident responders should monitor for unauthorized access attempts originating from the identified infrastructure, particularly in environments where trading or investment-related services are accessed.