tradedays[.]top

Analysis as of July 25, 2026 indicates that the domain tradedays.top is actively hosting a crypto‑related giveaway phishing campaign. The site was registered on December 04, 2025 through NiceNIC International Group Co., Limited and is currently resolved to the IP address 172.67.214.160, which belongs to AS13335 Cloudflare, Inc. in the United States. Network fingerprinting shows the presence of Hostinger hosting services, Cloudflare Browser Insights, and HTTP/3 support, confirming that the infrastructure relies on Cloudflare’s edge network. The TLS certificate presented by the server is issued by Google Trust Services under the WE1 label, suggesting a valid‑looking HTTPS connection despite the underlying malicious intent.

An HTTP 525 response code is observed, indicating that Cloudflare could not reach the origin server, a pattern often seen in transient phishing infrastructure. Reputation data shows that nine of ninety‑three VirusTotal scanners have flagged the domain, and the domain appears on a single security blocklist, where it is already blocked by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low credibility of the site. The page title “Trade Day NFT GIveaway” and the classification of the underlying kit as a Giveaway Scam align with the listed scam type of a crypto scam, suggesting the campaign attempts to lure victims with promises of free NFTs or cryptocurrency.

While the available intelligence confirms the presence of phishing‑related indicators, the actual content of the landing page has not been publicly disclosed, leaving the exact lure mechanisms unknown. Defenders should treat the domain as high‑risk: block DNS resolution, add the IP to outbound filtering rules, monitor for TLS connections to the Google‑issued certificate, and consider sinkholing traffic to prevent credential harvesting.