promptherplex2u[.]live

The domain promptherplex2u.live was registered on May 25, 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. DNS resolution points to the IP address 104.21.17.192, which belongs to Cloudflare (AS13335) and is geolocated in the United States. The domain is served through Cloudflare’s infrastructure, using the nameservers april.ns.cloudflare.com and ishaan.ns.cloudflare.com, and delivers content over HTTPS with a valid Let's Encrypt certificate (E8). The observed page title, "Prompt Herplex 2U | Official Platform for AI Assisted Trading," is delivered with modern web technologies including Unpkg, jsDelivr, jQuery, Cloudflare Browser Insights, and HTTP/3, indicating a legitimate‑looking front‑end. Intelligence sources classify the site as a credential phishing operation targeting users who may be interested in AI‑assisted trading services. One of ninety‑one VirusTotal scanners flagged the domain, and the site is listed on a public blocklist and has been blocked by PhishDestroy. Additional risk indicators include a Gridinsoft trust score of 0 out of 100 and a high risk rating. While the specific phishing mechanics (e.g., login form structure or harvested data) have not been publicly disclosed, the combination of recent registration, use of reputable hosting services to mask malicious intent, and the presence of a known phishing classification provide sufficient evidence for defensive action. Organizations should block the domain and its associated IP at network perimeter devices, update URL filtering policies, and monitor for any outbound connections to the IP address. Continuous threat‑intel feeds should be consulted for potential reuse of the infrastructure in related campaigns, and any credential submissions captured by security appliances should be investigated for compromise.