valuedtrades[.]org

Analysis of valuedtrades.org indicates an active credential phishing operation first registered on June 28, 2026, through Dynadot Inc. The domain currently resolves to 198.251.81.81 (AS53667, US-based hosting) and returns an HTTP 200 status, suggesting the phishing page remains accessible. Security vendors have flagged the domain in recent scans, with five detections reported among 91 engines. The infrastructure is also listed in four threat intelligence pulses and appears on three security blocklists, including PhishDestroy and MetaMask. Technical indicators reveal the use of common web frameworks (Bootstrap, jQuery, Moment.js) alongside tracking or interactive elements (Smartsupp, Slick, amCharts). The SSL certificate is issued by Let's Encrypt (YR2), a frequent choice for both legitimate and malicious sites. Nameservers point to asurahosting.com and my-control-panel.com, a pattern observed in other phishing campaigns leveraging the same provider. While the exact target or brand impersonated is not specified in available data, the domain is explicitly classified as credential phishing. Defenders should prioritize blocking the domain and its associated IP, particularly in environments where user authentication occurs. Given the domain's recent registration and active status, monitoring for related infrastructure (e.g., subdomains, newly registered lookalike domains) is recommended. No evidence suggests this campaign is inactive or mitigated.