tradz[.]pro

On 24 July 2026, the domain tradz.pro was observed serving a page titled “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | TradZ”. The site is registered through Web Commerce Communications Limited and was created on 29 September 2025. DNS resolution points to the Cloudflare network (ASN 13335) at 188.114.97.3, with authoritative nameservers katja.ns.cloudflare.com and weston.ns.cloudflare.com. An HTTPS certificate issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain validates the host, confirming the use of Cloudflare’s edge security services.

HTTP requests return a 403 status code, and the domain is currently marked as offline, indicating that the malicious content is no longer publicly reachable. Threat intelligence sources have classified the site as a brand‑impersonation operation targeting the “across” brand, presenting itself as a cryptocurrency exchange. It appears on at least one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports that 15 out of 95 scanning engines flag the domain as malicious, providing additional corroboration of its abusive intent.

The presence of the Cloudflare technology stack suggests the operators leveraged a fast‑changing infrastructure to hide origin details, a common tactic in phishing campaigns. While the page title and registration data give a clear picture of the malicious intent, the exact content of the landing page, credential‑capture mechanisms, and any associated command‑and‑control infrastructure remain unknown because the site is offline. Defenders should continue to monitor DNS queries for tradz.pro and related Cloudflare IP ranges, enforce blocklist entries in web‑filtering solutions, and update email security gateways to flag any messages referencing the “Buy & Sell Bitcoin, Ethereum” phrasing. Additional investigation of historical HTTP archives or third‑party crawls may reveal the full payload, aiding in attribution and remediation.