access-trade[.]app

Analysis of the domain access-trade.app, observed on July 23 2026, classifies it as a generic phishing site. The domain was created on 21 February 2026 and is registered through NiceNIC International Group Co., Limited. DNS resolution points to the IPv6 address 2606:4700:3037::ac43:b1db, which belongs to AS13335 Cloudflare, Inc. and resolves to a location in the United States. The authoritative nameservers are kehlani.ns.cloudflare.com and nile.ns.cloudflare.com, indicating that the domain is fully protected by Cloudflare’s infrastructure, including HTTP/3 support.

An SSL certificate issued by Google Trust Services under the “WE1” designation is present, confirming the use of valid TLS but offering no indication of legitimacy. HTTP requests to the site return a 403 status code, and the page title reported by the scanner reads “Suspected phishing site | Cloudflare”. The domain appears on a single security blocklist, specifically PhishDestroy, and has been flagged by 14 of 93 security vendors on VirusTotal, reflecting moderate detection consensus. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

No additional intelligence such as Safe Browsing, OTX, or brand-specific targeting is available. The current operational status is offline, suggesting that the phishing campaign has been taken down or the infrastructure has been disrupted. Defenders should continue to block the IPv6 address and associated Cloudflare hostnames, enforce sink-holing of the domain, and monitor for any re-registration attempts. Observers are advised to keep the domain under watch in threat-intel feeds and to incorporate the registrar and nameserver details into automated detection rules to reduce exposure to future campaigns that may reuse similar infrastructure.