connect[.]bulletintrades[.]com

The domain connect.bulletintrades.com was registered on April 08, 2026 through GO54 Limited and is hosted on a Contabo GmbH server in France (IP 193.187.129.25). The authoritative name servers ns1.tradexsplit.com and ns2.tradexsplit.com resolve to the same IP address, indicating a single‑host deployment typical of low‑cost malicious infrastructure. The site presented a Let's Encrypt R13 TLS certificate, which does not provide any inherent trust but confirms that an HTTPS endpoint was reachable prior to takedown.

Two of ninety‑four security vendors on VirusTotal flagged the domain, and the domain appears on at least one public blocklist, including PhishDestroy. Gridinsoft’s automated trust scorer assigned a value of 0 out of 100, reflecting an absence of reputable activity. The listed scam type is “Fake Exchange,” suggesting the site attempted to lure victims into providing credentials for a financial exchange platform, although no specific brand name is disclosed in the available metadata.

The domain is currently offline, and no HTTP response body, page title, or content snapshots have been captured, leaving the exact visual mimicry unknown. Analysts should continue to block traffic to the IP address and the domain, monitor for any re‑registration or related sub‑domains under the same name servers, and add the domain to internal threat‑intel feeds. Given the elevated risk rating, network defenders are advised to implement DNS sinkholing for the domain, enforce outbound TLS inspection to detect similar Let's Encrypt‑issued certificates, and review logs for any prior connections to 193.187.129.25 that may indicate compromised credentials or data exfiltration attempts.