mt5onlinetrading[.]us

PhishDestroy identifies mt5onlinetrading.us as an active MetaTrader 5 (MT5) credential phishing domain designed to lure traders into surrendering login credentials for the popular trading platform. The domain mimics the official MetaTrader branding to deceive users into believing they are accessing a legitimate service, likely hosted on a compromised or malicious server (IP 163.61.188.7). Upon visiting, users are presented with counterfeit login portals that harvest account details, which are then exploited for unauthorized trading access or sold on dark web markets. Security teams should treat this domain as a high-priority threat due to its immediate exploitation potential and deceptive branding. This domain exhibits several red flags confirmed by PhishDestroy’s technical analysis. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com, mt5onlinetrading.us was created on October 29, 2025—an unusually recent date that suggests opportunistic registration following a known campaign or brand exploitation trend. The domain currently resolves to IP address 163.61.188.7 and is secured with a Let’s Encrypt SSL certificate, a tactic commonly used to appear legitimate. Critically, VirusTotal currently reports 0 detections out of 95 engines, indicating evasion of automated detection systems. While the absence of blocklist entries suggests this domain has flown under the radar, its recent creation and MT5 branding make it a high-risk candidate for immediate inclusion in enterprise threat feeds and browser blocklists. All users and organizations that may have encountered mt5onlinetrading.us are strongly advised to take immediate action. If you visited the site and entered any credentials or financial information, change your MT5 account password immediately and enable two-factor authentication. Scan your device with updated antivirus software and review account activity for unauthorized transactions. Report the domain to your IT security team and consider using DNS filtering tools to block access. For further threat intelligence, access the full PhishDestroy report to verify indicators of compromise and implement proactive monitoring. Act now—this domain represents a live threat to financial account integrity.