bleutrade[.]io

The domain bleutrade.io was created on October 31, 2025 and is currently taken offline. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The authoritative name servers are bill.ns.cloudflare.com and jacqueline.ns.cloudflare.com, indicating the use of Cloudflare's DNS infrastructure. No TLS certificate is presented for the domain, meaning HTTPS connections are not available and any attempt to access the site would fall back to HTTP, a typical characteristic of low‑trust phishing infrastructure.

The page title returned from the site, "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | BLEUTRADE," suggests the operator attempted to pose as a cryptocurrency exchange and specifically targets the Ethereum brand, as confirmed by the listed brand target and the impersonation flag. The domain was registered through NiceNIC International Group Co., Limited. Security intelligence shows eight of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single public security blocklist. PhishDestroy has also blocked the domain.

Reputation services assign a trust score of 1 out of 100 from both Gridinsoft and Scamadviser, reflecting an extremely low confidence level in the site's legitimacy. Although the site is no longer reachable, the combination of Cloudflare‑hosted infrastructure, lack of SSL, brand‑targeted title, and low trust scores strongly indicate a brand‑impersonation campaign aimed at Ethereum users. Defenders should continue to monitor the IP address 188.114.97.3 for any reactivation, enforce blocklisting of the domain in network defenses, and educate users about the absence of HTTPS and the suspicious page title. Further investigation is limited by the offline status of the site, so additional payloads or phishing pages cannot be examined at this time.