expresstrade[.]ltd[.]trumpbackupqfs[.]com

The domain expresstrade.ltd.trumpbackupqfs.com is currently under investigation for brand impersonation, specifically targeting the ExpressTrade brand across multiple sectors. This domain remains active and poses a potential threat to users who may mistake it for the legitimate ExpressTrade platform. The page title displayed is "ExpressTrade - Home," which further reinforces the impersonation attempt.

Technical analysis reveals that the domain was registered on April 18, 2025, through Tucows Domains Inc. It resolves to IP address 198.12.66.123 and has no SSL certificate, making any data transmitted to it insecure. Despite appearing on one security blocklist, VirusTotal reports zero detections out of 95 vendors, indicating that it has not yet been widely flagged as malicious. However, the lack of SSL and recent registration date are concerning indicators.

PhishDestroy recommends treating this domain with high suspicion due to the brand impersonation risk and absence of encryption. Users should avoid interacting with the site and verify any communications claiming to be from ExpressTrade through official channels. The domain is still active, so continued monitoring is advised, and organizations should implement blocks to prevent employee access.