ftp[.]uptradeinvestment[.]com

Analysis as of July 26, 2026 indicates that the domain ftp.uptradeinvestment.com is currently classified as a high‑risk generic phishing site. The domain resolves to the authoritative name servers ns3.ddoscure.com and ns4.ddoscure.com, both of which are associated with the DNS provider ddoscure.com. Registration was performed through Dynadot Inc, a registrar that does not inherently imply legitimacy. An HTTP request to the site returns a 403 Forbidden response, suggesting that direct content retrieval is blocked or that the server is configured to deny access without proper credentials.

The domain is listed on a single security blocklist and has been flagged by the PhishDestroy mitigation service, confirming that it is still active in the phishing ecosystem. VirusTotal analysis shows that 12 of 91 scanned security vendors have reported the domain as malicious, providing independent corroboration of its threat status. The presence of these detections, combined with the blocklist entry and the PhishDestroy flag, establishes a clear malicious profile.

No additional evidence such as SSL certificates, page titles, or Safe Browsing alerts is available in the current intelligence set, leaving the exact payload or impersonated brand undisclosed. Defenders should immediately block any outbound or inbound traffic to ftp.uptradeinvestment.com at the network perimeter, update intrusion detection signatures to include the domain, and monitor for related DNS queries to the associated name servers. Continuous re‑evaluation is advised, as further telemetry may reveal additional infrastructure components or victim targeting patterns.