nobletradingpro[.]com

Analysis of nobletradingpro.com shows a short-lived infrastructure supporting a fake exchange phishing campaign. The domain was registered through Dynadot LLC on March 11, 2026 and points to the IP address 89.187.25.21, which is assigned to Ultahost, Inc. in the Netherlands (AS214036). All four authoritative name servers—ns1.ultahost.com through ns4.ultahost.com—resolve to the same hosting provider, indicating a single‑point hosting arrangement. The site presented the page title "HOME | Noble Trading Pro - Most Innovative Trading Platform in the UK," suggesting an attempt to impersonate a UK‑based trading service.

An SSL certificate issued by Let’s Encrypt (certificate identifier E8) was active, offering encrypted transport but providing no validation of the underlying entity. The domain appears on one external security blocklist and was flagged by PhishDestroy as a malicious site. VirusTotal scans returned two positive detections out of ninety‑five scanners, reinforcing the suspicion of malicious intent. Current network probes show the domain is offline, consistent with a takedown or temporary suspension.

The observable evidence confirms the domain’s use for a fake exchange phishing operation, but the exact payload, credential‑stealing mechanisms, or victim interaction pathways remain unverified due to the offline status. Defenders should continue to block the domain at perimeter filters, monitor the associated IP range for any re‑use, and update internal threat intel repositories with the registration and hosting details. Threat hunting teams should also watch for variations of the page title or similar naming patterns that reference "Noble Trading Pro" to catch potential redeployments of this phishing kit.