altitradingltd[.]com

The domain altitradingltd.com was registered through Tucows Domains Inc. on May 29, 2025 and currently resolves to the Cloudflare address 172.67.140.86, which is associated with AS13335 in the United States. No SSL certificate is presented for the site, indicating that any traffic would be unencrypted. The page title returned by the server is "Alti Trading – Alri Trading," a generic title that does not reference the impersonated brand. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy. Intelligence from AlienVault OTX shows the domain appearing in two threat‑intel pulses, and VirusTotal reports three of ninety‑five security vendors flagging it as malicious.

Reputation services rate the site poorly, with Scamadviser assigning a trust score of 26 out of 100 and Gridinsoft reporting a score of 0 out of 100. The site is classified as a "Fake Exchange" and is explicitly noted to impersonate the Telegram brand. Nameservers are doug.ns.cloudflare.com and melina.ns.cloudflare.com, confirming use of Cloudflare DNS. The domain’s current status is offline, suggesting that the malicious content has been taken down or is temporarily unavailable. Defenders should treat any recent or historic traffic to this domain as potentially malicious, especially if it involves credential capture or credential‑stealing flows targeting Telegram users.

Network sensors should continue to block the IP 172.67.140.86 and any future resolutions of the domain. Threat‑intel feeds should be updated to reflect the brand‑impersonation indicator, and endpoint detection rules should be tuned to flag any attempt to load resources from this host. Because the site is offline, further passive DNS or archival analysis may be required to uncover the exact payload or phishing page that was previously served. Until such artifacts are recovered, the conservative posture is to maintain blocklists and monitor for re‑appearance of the domain or related infrastructure.