ctplt[.]trade

The domain ctplt.trade is actively hosting a fake login page designed to harvest user credentials. Designated as a generic phishing threat, this site poses a high risk due to its active status and the absence of current detection on VirusTotal. The domain resolves to IP address 188.114.97.3, a server associated with malicious infrastructure, and was registered on April 27, 2026. This recent creation date suggests a newly deployed campaign with minimal historical footprint, increasing the likelihood of evading traditional security measures. PhishDestroy’s analysis reveals that ctplt.trade is currently undetected on VirusTotal (0 detections out of 95 scans) as of the latest check. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for anonymity-friendly registrations, and uses a Let’s Encrypt SSL certificate to appear legitimate. The IP address 188.114.97.3 is part of a block (ASN 14061, DigitalOcean) that has been intermittently flagged for hosting phishing infrastructure, though no blocklists currently list ctplt.trade specifically. The absence of detections and recent registration timeline indicate this is an emerging threat with potential for rapid expansion. To mitigate risk, users must avoid interacting with ctplt.trade entirely. If credentials were entered, change passwords immediately and enable multi-factor authentication on all associated accounts. Organizations should block the domain and IP at the network level and monitor for related artifacts. PhishDestroy users are advised to submit any suspicious links via the platform for real-time verification and threat intelligence updates. Immediate action is critical due to the active and undetected status of this campaign.