tradexyz[.]forum

tradexyz.forum was registered on May 04, 2026 through Global Domain Group LLC and is currently resolved to the Cloudflare‑owned address 188.114.97.3, located in Canada. The domain is served over HTTPS using a Let’s Encrypt certificate (issuer E8) and answers HTTP requests with status 200. The page title returned by the server is “Trade[XYZ]”, a typical lure for financial‑service victims.

Reputation services flag the domain as high‑risk. Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX records a single pulse referencing the host. VirusTotal reports two detections out of ninety‑five scanned security vendors. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. These independent signals converge on a malicious classification.

The threat type is cataloged as generic_phishing, indicating a credential‑harvesting campaign that likely mimics legitimate trading platforms. The use of Cloudflare’s DNS (dalary.ns.cloudflare.com, ernest.ns.cloudflare.com) and a recently issued SSL certificate suggest an effort to gain user trust while obscuring the true infrastructure. The short registration window—less than three months—combined with the high‑risk indicators points to a purpose‑built phishing operation rather than an incidental compromise.

Defenders should add tradexyz.forum to outbound‑web filters and blocklist it at the network perimeter. Email security gateways ought to flag any messages containing URLs that resolve to 188.114.97.3 or that reference the “Trade[XYZ]” page title. Continuous monitoring of the IP address for new subdomains or related CNAME records is advised, as attackers frequently repurpose Cloudflare‑protected hosts. Incident response teams should treat any credential submissions to this site as compromised and advise affected users to reset passwords immediately.