DNS Analysis Links SourTrade IoCs to Malicious Domains and IP Addresses
Summary
An analysis of 96 SourTrade domain IoCs found related typosquatting domains, malicious email-connected domains and IP addresses, and historical DNS activity. SourTrade has reportedly used malvertising to distribute unfinished malware targeting retail traders and crypto-
Key points
- SourTrade has reportedly been active since late 2024, using malvertisements that mimic TradingView, Solana, and Luno to target retail traders and crypto investors.
- The researchers analyzed 96 domain IoCs and found four associated with typosquatting groups and 14 previously listed in a malicious-domain feed.
- WHOIS history linked 47 IoCs to 34 public email addresses; searches using those addresses found 348 additional domains, 131 of which were reported as weaponized.
- DNS lookups found that 95 IoCs resolved to 186 distinct IP addresses; 184 were identified as malicious by the cited threat-intelligence data.
- The researchers report 2,217 historical domain-to-IP resolutions across the IoCs and note one client IP that queried an IoC domain on July 7, 2026.
- The article cautions that entities labeled malicious may need further investigation to confirm their status.
Article Details
- Attack Vectors
- Malvertisements mimicking TradingView, Solana, and Luno were used to distribute unfinished malware targeting retail traders and crypto investors.
- The article reports domains associated with malware distribution, phishing, command-and-control, and other generic threats.
- Defensive Notes
- The researchers recommend supplementary investigation to corroborate entities identified as malicious, noting that classifications may change with further investigation or context.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | acuitycore[.]digital | SourTrade domain IoC listed in the malicious-domains feed. |
| DOMAIN | alarde[.]digital | Email-connected domain reported as weaponized for malware distribution. |
| DOMAIN | asiadataintelligencelab[.]digital | SourTrade domain IoC listed in the malicious-domains feed. |
| DOMAIN | balomboa[.]site | Email-connected domain reported as weaponized for malware distribution. |
| DOMAIN | beacon-net[.]digital | Identified as a SourTrade domain IoC and listed in a typosquatting group. |
| DOMAIN | beaconmeet[.]com | Identified as a SourTrade domain IoC and listed in a typosquatting group. |
| DOMAIN | calvexis[.]info | Email-connected domain reported as weaponized for malware distribution. |
| DOMAIN | dinexa[.]digital | Email-connected domain reported as weaponized for malware distribution. |
| DOMAIN | dotlor[.]site | SourTrade domain IoC with historical domain-to-IP resolutions. |
| DOMAIN | enterlock[.]digital | Email-connected domain reported as weaponized for malware distribution. |
| DOMAIN | form-engine[.]digital | Identified as a SourTrade domain IoC and listed in a typosquatting group. |
| DOMAIN | form-networktool[.]digital | Domain IoC contacted by a client IP address in DNS queries on 7 July 2026. |
| DOMAIN | insight-radiant[.]digital | SourTrade domain IoC listed in the malicious-domains feed. |
| DOMAIN | nebive[.]site | SourTrade domain IoC with historical domain-to-IP resolutions. |
| DOMAIN | prolega[.]site | SourTrade domain IoC with historical domain-to-IP resolutions. |
| DOMAIN | qumoro[.]site | SourTrade domain IoC with historical domain-to-IP resolutions. |
| DOMAIN | syscodeapi[.]digital | SourTrade domain IoC listed in the malicious-domains feed. |
| DOMAIN | transoe[.]site | SourTrade domain IoC with historical domain-to-IP resolutions. |
| IPV4 | 104[.]21[.]0[.]150 | IP reported as malicious and associated with malware distribution. |
| IPV4 | 104[.]21[.]1[.]243 | IP reported as malicious and associated with malware distribution and phishing. |
| IPV4 | 104[.]21[.]15[.]11 | IP reported as malicious and associated with malware distribution, C&C, and generic threats. |
| IPV4 | 172[.]67[.]129[.]18 | IP reported as malicious and associated with malware distribution, phishing, and generic threats. |
| IPV4 | 172[.]67[.]129[.]27 | IP reported as malicious and associated with malware distribution. |
Products
LunoActive since late 2024, SourTrade has become known for mimicking TradingView, Solana, and Luno to go after retail traders and crypto investors.SolanaActive since late 2024, SourTrade has become known for mimicking TradingView, Solana, and Luno to go after retail traders and crypto investors.TradingViewActive since late 2024, SourTrade has become known for mimicking TradingView, Solana, and Luno to go after retail traders and crypto investors.