secureassetstrading[.]com

secureassetstrading.com was first observed on March 22, 2026, when the domain was registered through Dynadot Inc. Within weeks the domain appeared on a public security blocklist and has since been referenced in ten AlienVault OTX pulses. VirusTotal records show that 15 of 95 scanning engines have flagged the domain for malicious activity, and the site is actively blocked by the PhishDestroy feed. The domain resolves to the IPv4 address 198.251.89.220, which is geolocated to Luxembourg and is associated with the organization FranTech Solutions. Both authoritative name servers, ns27.my‑control‑panel.com and ns28.my‑control‑panel.com, resolve to the same IP, indicating a single‑host deployment. The sole MX record points to secureassetstrading.com itself, and the web server returns an HTTP 307 redirect without presenting an SSL certificate, confirming the absence of TLS protection. Gridinsoft assigns a trust score of 35 out of 100, reflecting a low confidence rating. The lack of HTTPS combined with the redirect behavior is consistent with a credential‑phishing landing page that forwards victims to a counterfeit exchange portal. The intelligence categorizes the campaign as a “Fake Exchange” credential phishing operation. No additional infrastructure such as secondary C2 servers or malware drops has been observed, suggesting the primary objective is to harvest login credentials for a financial trading platform. The domain’s recent creation date, rapid appearance on blocklists, and the modest number of VirusTotal detections indicate a focused, short‑lived campaign rather than a long‑standing infrastructure. Defenders should add secureassetstrading.com and its resolving IP 198.251.89.220 to deny‑list rules across DNS, web proxy, and email filtering systems. Continuous monitoring of the two name servers is advised to detect any expansion of the hosting footprint. Incident response teams should treat any email that references the domain as malicious and enforce credential‑reset procedures for users who may have entered credentials on the site. Threat‑intel sharing platforms should be updated with the observed indicators of compromise to accelerate downstream detection.