expertrades[.]ltd

The domain expertrades.ltd was registered on 21 February 2026 through Sav.com, LLC. DNS resolution points to the IPv4 address 173.0.59.2, which belongs to AS27323 (Wowrack.com) located in the United States. The authoritative name servers are ns1.korrectserver.com and ns2.korrectserver.com, and the domain publishes an MX record with priority 0 that resolves to expertrades.ltd itself, indicating a self‑hosted mail service. An SSL certificate issued by Let’s Encrypt (R13) is present, confirming the site operated over HTTPS. Web‑technology fingerprinting identified Bootstrap, LiteSpeed, Smartsupp, jQuery and HTTP/3 support, suggesting a modern web stack typical of disposable phishing pages. VirusTotal reports that 2 of 93 scanned security vendors flagged the domain, providing independent confirmation of malicious activity.

The site appears on a single known security blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low confidence in the domain’s legitimacy. The page title returned by the server is “expertrades.ltd Massive Profit Hourly,” which aligns with the generic phishing classification present in the intelligence feed. Current monitoring indicates the domain has been taken offline, but the underlying infrastructure – IP address, name servers and SSL certificate – remains allocated and could be re‑activated.

No additional public threat‑intel sources such as OTX or Safe Browsing are referenced, leaving the full scope of associated campaigns uncertain. Defenders should continue to block any traffic to 173.0.59.2 and to expertrades.ltd at the DNS level, enforce TLS inspection to capture any residual HTTPS payload, and monitor the associated name servers for rapid re‑registration. Updating internal blocklists with the domain, its IP, and its MX record will reduce the risk of inadvertent credential harvesting.