tv-tradingview[.]com

Analysis of the domain tv-tradingview.com confirms its classification as a fake exchange phishing site targeting the Across brand. Registered on September 28, 2025, through Gname.com Pte. Ltd., the domain resolved to the IP address 172.67.171.142, hosted under AS13335 (Cloudflare, Inc.) in the United States. The domain's nameservers, deborah.ns.cloudflare.com and elliott.ns.cloudflare.com, further link it to Cloudflare infrastructure, a common tactic to obscure hosting origins and evade takedowns. The page title, 'TradingView — Track Every Market,' directly mimics the branding of the legitimate TradingView platform, aligning with the scam type labeled as a 'Fake Exchange.' This impersonation is corroborated by the domain's explicit targeting of Across, as noted in threat intelligence sources.

Detection metrics indicate elevated risk: the domain appears on one security blocklist, and 14 of 95 security vendors on VirusTotal flagged it as malicious. Gridinsoft assigned a trust score of 0/100, reinforcing its fraudulent nature. The domain was blocked by PhishDestroy and is currently offline, though its prior activity warrants continued monitoring. Infrastructure analysis reveals the use of a Google Trust Services SSL certificate (WE1), a common practice among phishing domains to appear legitimate.

The domain's creation date, nearly ten months prior to the report date, suggests prolonged preparation or delayed deployment. Defenders should treat this domain as a confirmed threat, particularly for users interacting with Across or TradingView-related services. Given its offline status, further analysis of archived content may provide additional indicators of compromise, though no live samples are currently available for inspection.