fxtmtrade[.]live

This domain, fxtmtrade.live, is actively flagged as a high-risk phishing site targeting financial trading users, specifically leveraging a 'Bot Verification' page title as its entry vector. Analysis indicates the domain was registered on March 26, 2026, through Dynadot Inc, and is hosted on infrastructure associated with FranTech Solutions in Luxembourg, resolving to IP 198.251.84.236. The SSL certificate is issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious sites, offering no inherent trust signal. The domain appears on three security blocklists and is recognized in at least one threat intelligence pulse, confirming its malicious classification. Nameservers ns113.my-control-panel.com and ns114.my-control-panel.com are linked to low-reputation hosting environments frequently exploited for phishing operations. Defenders should note that the domain returns an HTTP 200 status, indicating an active and accessible phishing page, despite being blocked by multiple security layers. The 'Bot Verification' page title suggests an attempt to bypass automated security checks or trick users into completing fraudulent verification steps, a tactic often used in credential harvesting or account takeover schemes. While the exact brand impersonation is not confirmed in available data, the domain name implies a focus on forex or trading platforms. No evidence of a known phishing kit or specific scam subtype (e.g., crypto drainer, investment fraud) is present in the current intelligence. Infrastructure analysis reveals a short-lived domain (under four months old) with no historical reputation, a pattern consistent with disposable phishing sites. The hosting provider, FranTech Solutions, is frequently used for bulletproof or low-cost hosting, further reducing the likelihood of rapid takedown.