earnixtrades[.]com

This domain, earnixtrades.com, is currently classified as a high‑risk brand‑impersonation campaign. The site resolves to the IPv4 address 198.251.89.205, which is advertised as belonging to AS53667 FranTech Solutions in the United States. Registration information shows the domain was created on 15 September 2025 and was obtained through Global Domain Group LLC. Authoritative name servers are ns111.my‑control‑panel.com and ns112.my‑control‑panel.com, and the site presents a valid Let's Encrypt certificate (issued by “E7”). The public page title reads “Forex Broker and Cryptocurrency Investment with | Earnix Trade,” indicating an attempt to lure victims interested in forex or crypto services. Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on a single security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports a single detection out of ninety‑five scanning engines. No further technical artifacts such as malware hashes or command‑and‑control indicators have been disclosed. The available evidence suggests that the infrastructure is deliberately lightweight, possibly to reduce exposure while targeting investors. Because the underlying page content has not been independently verified, analysts should treat any credential‑collection forms or download prompts as potentially malicious. Defenders are advised to add 198.251.89.205 and earnixtrades.com to outbound and inbound filtering rules, monitor DNS queries for the associated name servers, and continue to track any additional detections that may appear on broader threat‑intel feeds.