zardeltrading[.]net

Analysis of zardeltrading.net shows a high‑risk phishing campaign targeting users of exchange services. The site presents the page title "Nur einen Moment…" and is classified as a "Fake Exchange" scam. The domain was registered on May 30 2022 through 1API GmbH and uses four DNS records (ns1.dnsimple.com, ns2.dnsimple‑edge.net, ns3.dnsimple.com, ns4.dnsimple‑edge.org). DNS resolution returns the IPv6 address 2606:4700::6810:10c2, which belongs to a US‑based network operated by a major content delivery provider (ASN 13335). HTTP requests receive a 403 response, and the TLS certificate is issued by a widely trusted public certificate authority (Google Trust Services / WE1). Technical fingerprints reveal a Ruby‑based application stack with caching, payment‑processing and subscription‑billing components, and the presence of a CDN. Threat intelligence sources list the domain in one pulse on AlienVault OTX and it is blocked by PhishDestroy, appearing on a single security blocklist. VirusTotal reports a single vendor flag among 95 scanners. The site remains active. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the identified IP range, and flag any credential or payment‑information submissions to this host as malicious. Continuous re‑evaluation is advised, as the infrastructure may evolve.