culttraders[.]xyz

Analysis as of August 03, 2026 indicates that the domain culttraders.xyz was registered on July 30, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare infrastructure (nameservers hugh.ns.cloudflare.com and savanna.ns.cloudflare.com) resolving to IP 172.67.187.153. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records show four of ninety‑one scanning engines flag the domain, confirming malicious classification.

No additional public intelligence such as OTX entries, Safe Browsing verdicts, or SSL certificate details are currently available. The short age of the domain, combined with the presence on multiple blocklists and the detection by several security vendors, suggests a high likelihood of phishing use. However, the lack of publicly disclosed page title, brand targeting, or sample payload limits the ability to attribute a specific phishing campaign or to confirm the exact luring technique.

Defenders should proactively block or sinkhole the domain at network perimeter, update DNS filtering rules to include the identified IP address and nameservers, and monitor for any outbound connections to the Cloudflare edge. Incident response teams should treat any credential submission or authentication attempt to URLs under culttraders.xyz as compromised and enforce MFA where possible. Continuous re‑scanning with VirusTotal and periodic checks against emerging blocklists are recommended to capture any changes in the domain's behavior.