tradingview[.]to

The domain tradingview.to was observed conducting brand impersonation phishing targeting Discord users. It presented itself as a legitimate TradingView service but was designed to harvest credentials or spread malware through social media scams. No crypto drainer kit was detected. The site is currently taken offline, though its prior activity poses a risk to users who may have interacted with it.

Technical indicators show tradingview.to was registered through NameCheap, Inc. on 2019-09-29 18:30:58 and resolved to IP address 199.36.158.100, hosted on AS54113 (Fastly, Inc.) in the US. The SSL certificate was issued by Google Trust Services / WR3. At the time of analysis, 0 of 95 VirusTotal vendors flagged the domain, and Google Safe Browsing did not list it, though it appeared on 1 security blocklist (PhishDestroy). The observed page title was 'TradingView To Anywhere - Automate Your Alerts', and detected technologies included Node.js, Firebase, Google Cloud, and Express.

Users who visited tradingview.to should immediately change any passwords entered on the site, enable two-factor authentication on Discord and linked accounts, and monitor for unauthorized activity. Report the domain to Discord’s official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group. If financial or crypto accounts were accessed, revoke token approvals and consider migrating funds to a new wallet.