webinar[.]trendlineforex[.]com

webinar.trendlineforex.com was observed hosting a page titled “Зад кулисите на Forex брокера”. The domain resolves to 148.105.251.16, an IP registered to AS14782 MailChimp in the United States. Registration was performed through Cloudflare, Inc., and the authoritative nameservers are ruben.ns.cloudflare.com and teagan.ns.cloudflare.com. The site presented an HTTP 404 response at the time of analysis, and the TLS certificate is issued by Let’s Encrypt (YR2). VirusTotal recorded three positive detections out of ninety‑one scanned vendors, and the domain appears on a single security blocklist.

PhishDestroy has also classified the domain as malicious and has taken it offline. The domain was created on 12 January 2021 and is currently listed as offline. The available evidence points to a generic phishing infrastructure that leverages Cloudflare’s DNS and CDN services to mask the true hosting location. The presence of a MailChimp‑associated AS suggests possible reuse of compromised email‑marketing resources, but the exact payload or credential‑harvesting mechanism has not been disclosed. The 404 status indicates that the malicious page may have been removed or is temporarily inaccessible, which aligns with the “taken offline” status reported by PhishDestroy.

Defenders should continue to block the domain at network perimeter and DNS resolvers, enforce the existing blocklist entry, and monitor for any resurgence of activity from the same IP address or associated Cloudflare nameservers. Additional investigation of traffic logs for connections to 148.105.251.16 may reveal residual command‑and‑control or data‑exfiltration attempts. Because the TLS certificate is publicly trusted, any future re‑hosting of the domain could regain credibility, so periodic re‑scanning is recommended. Until further malicious content is observed, the domain remains a low‑confidence threat, but its prior detections justify maintaining the elevated risk posture.