treadperfectunitexchange[.]com

treadperfectunitexchange.com was registered on March 22 2026 through TuringSign Inc. d/b/a Cosmotown. The domain is delegated to four LyteHosting name servers (dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, dns4.lytehosting.com) and resolves to the IPv4 address 163.61.188.2. VirusTotal analysis shows that one of ninety‑one scanning engines flagged the domain, indicating at least a single detection of malicious behavior. The domain appears on a single public security blocklist and is actively blocked by the PhishDestroy feed, confirming that defensive tooling already recognizes it as hostile.

The risk rating assigned by the reporting source is high, and the operational status remains active as of the report date, July 27 2026. The available telemetry does not include additional indicators such as SSL certificate details, HTTP response codes, page title, or content analysis, so the precise phishing payload or targeted brand cannot be confirmed at this time. The limited detection footprint—only one vendor flag and a single blocklist entry—suggests that the infrastructure may be newly deployed or employing evasion techniques to avoid broader detection. However, the presence of a dedicated blocklist entry and a confirmed detection by a security vendor demonstrate that the domain is already being used for malicious purposes consistent with the generic phishing classification.

Defenders should add 163.61.188.2 and the associated name servers to network‑level deny lists, enforce DNS filtering for treadperfectunitexchange.com, and monitor for any future detections from additional scanning engines. Continuous re‑scanning of the domain on multi‑engine platforms is recommended to capture evolving threat signatures. Organizations that employ email or web gateway security should ensure that traffic to this domain is blocked and that any credential‑submission attempts to the domain are logged for investigation.