tradinero[.]io

Analysis of tradinero.io, first observed on June 16 2026, indicates that the domain is actively used for a generic phishing campaign. The registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain is served by Cloudflare infrastructure, as evidenced by the authoritative nameservers louis.ns.cloudflare.com and nancy.ns.cloudflare.com. DNS resolution points to the IP address 172.67.155.155, which belongs to Cloudflare’s network and therefore masks the underlying hosting provider. The domain has been flagged by multiple security services: five out of ninety‑one VirusTotal scanners have reported it as malicious, and it is listed on at least one external blocklist, specifically PhishDestroy, which has already taken action to block the domain.

As of the report date, July 26 2026, the domain remains active and continues to resolve to the same IP address. The limited visibility into the web content prevents a definitive description of the phishing payload, page title, or targeted brand. No additional telemetry such as Safe Browsing status, Open Threat Exchange reports, or SSL certificate details are currently available. Consequently, the full scope of the campaign, including victim demographics and attack vectors, remains uncertain.

Defenders should incorporate tradinero.io into their URL filtering and DNS blocking policies. Given its presence on a known blocklist and the detection by multiple antivirus engines, proactive measures such as sinkholing the domain, updating intrusion detection signatures, and monitoring outbound connections to the associated IP address are advisable. Continuous re‑evaluation is recommended, as the underlying infrastructure may shift if the operators change hosting arrangements.