badboy-trading[.]com

badboy-trading.com is currently offline and returns HTTP 403. The domain was registered through Tucows Domains Inc. on May 06 2024 and is hosted on Cloudflare (AS13335) with the IP address 104.16.12.194 located in the United States. DNS resolution points to the authoritative nameservers ns1.siteground.net and ns2.siteground.net, indicating the underlying web‑hosting provider is SiteGround while traffic is proxied through Cloudflare. The site presented the page title “Guadagno Automatico”, which is Italian for “Automatic Earnings”, and was classified as a “Fake Exchange” that impersonates the Polygon brand.

No visual analysis of the landing page is available, but the combination of the title, the brand target, and the fake‑exchange classification strongly suggests a financial‑theft scheme. Security‑vendor scans on VirusTotal recorded 16 detections out of 95 scanners, and the domain appears on a single public blocklist (PhishDestroy). Independent reputation services assign extremely low scores: Gridinsoft rates the site 0 / 100, and Scamadviser gives it 1 / 100. The SSL certificate is issued by Google Trust Services under the “WE1” designation, which is typical for Cloudflare‑proxied sites and does not mitigate the malicious intent.

Technology fingerprints include Ruby, RackCache, Stripe, Recurly, Cloudflare Browser Insights, and Cloudflare itself, confirming the use of common e‑commerce and payment‑processing components. These components are often abused to lend credibility to fraudulent financial offers. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed IP and hostnames, and monitor for any re‑hosting attempts that may reuse the same infrastructure. Because the domain is already taken offline, active takedown is complete, but threat‑intel feeds should retain the indicator set for correlation with future campaigns that may target Polygon users or reuse the “Guadagno Automatico” branding.