globalcopytrades[.]top

This domain, globalcopytrades.top, is identified as a fake trading platform phishing site targeting financial account credentials. Analysis confirms it operated as a generic phishing threat with no direct brand impersonation, though its infrastructure mimicked legitimate copy-trading services. The domain is currently offline, but prior activity warrants monitoring. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, registered through Atak Domain Bilgi Teknolojileri Inc., and resolved to IP 51.161.196.101 (OVH Australia PTY LTD). Created on May 15, 2026, with a Let's Encrypt SSL certificate (R13), it appeared on one security blocklist and was blocked by at least one anti-phishing system. The creation date suggests potential typosquatting on future domain registrations or an attempt to evade detection by pre-dating expected activity. The domain has been taken offline, but residual risk remains for systems that previously interacted with it. Organizations should add globalcopytrades.top to DNS sinkholes, web gateways, and email filtering rules. Security teams are advised to review logs for connections to 51.161.196.101 and inspect endpoints for artifacts linked to this phishing campaign. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.