tradeqxstart[.]com

Analysis of tradeqxstart.com shows the domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and points to the Cloudflare edge address 104.21.47.209, which belongs to AS13335 in the United States. The authoritative nameservers are irma.ns.cloudflare.com and leif.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site hosted a page titled "Quotex Trading: QxBroker Platform Review 2025", indicating a brand impersonation of Quotex, a known trading platform. The scam type is recorded as Brand Impersonation, and the domain appears on one security blocklist and is actively blocked by PhishDestroy.

VirusTotal scans show that two of ninety‑three security vendors flagged the domain, providing additional corroboration of malicious intent. No SSL certificate was observed, meaning the site did not serve HTTPS traffic. As of the report date, the domain is taken offline, preventing live analysis of the payload.

Defenders should add tradeqxstart.com to endpoint and DNS blocklists, monitor traffic to the associated Cloudflare IP for any residual activity, and consider broader heuristic rules that detect newly registered domains using Cloudflare nameservers combined with brand‑impersonation page titles. Continuous re‑inspection of the IP is recommended in case the infrastructure is repurposed for other campaigns. The presence on a public blocklist and the dual vendor detections constitute sufficient evidence to treat the domain as malicious and to enforce strict blocking policies.