tradedays[.]xyz

The domain tradedays.xyz was registered on 5 December 2025 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare‑hosted address 172.67.199.250, an IP owned by AS13335 in the United States. The domain is served by the Cloudflare nameservers camilo.ns.cloudflare.com and serena.ns.cloudflare.com and does not present an SSL/TLS certificate, indicating that it was accessed over plain HTTP when it was active. VirusTotal records show that four of ninety‑three scanning engines flagged the domain as malicious, and the site is listed on a single external security blocklist.

PhishDestroy has also recorded the domain as blocked. The page title observed during the brief live period was “Trade Day NFT GIveaway”, and the underlying phishing kit has been identified as a “Giveaway Scam” used to lure victims with a fake airdrop of NFTs. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

The current online status is offline, so the content cannot be inspected directly, but the combination of a low trust score, lack of encryption, a known scam kit, and multiple vendor detections provides strong evidence that the domain was employed for fraudulent NFT‑airdrop phishing. Defenders should continue to block the domain and the associated IP address, monitor for any re‑hosting on other Cloudflare‑owned IP ranges, and consider adding the domain to internal URL filtering and email security policies. Because the site is already offline, threat actors may attempt to reactivate the domain or clone the kit on new domains; continuous watch of newly registered .xyz names with similar patterns is recommended.