tread[.]fi

This domain, tread.fi, is a confirmed phishing site designed to deceive users seeking algorithmic trading terminals for digital assets. The threat involves credential harvesting or financial fraud, as the site mimics legitimate trading platforms to lure victims into entering sensitive information or connecting crypto wallets. The site is now offline, but its infrastructure and registration details indicate a deliberate malicious campaign.

Technical evidence shows that tread.fi was registered on October 01, 2022, through Gandi SAS, and resolves to IP address 52.223.52.2. VirusTotal analysis reveals 1 out of 95 security vendors flag the domain as malicious, and it appears on 1 security blocklist. The site uses an SSL certificate from Google Trust Services and employs technologies such as Framer Sites, React, HSTS, Google Analytics, and HTTP/3. The low detection rate (1/95) suggests the domain was designed to evade initial security screening.

Users who visited tread.fi should immediately change passwords for any accounts accessed on the site, enable two-factor authentication on all financial platforms, and monitor for unauthorized transactions. If credentials were entered, assume they are compromised and revoke any API keys or wallet connections. Run a full antivirus scan on the device used and report the incident to relevant financial institutions. No further interaction with the domain is advised as it is now offline.