A DNS Investigation of the SourTrade Browser-Assembled Malware Campaign
Confiant documented¹ SourTrade, a malvertising operation active since late 2024 that impersonates TradingView, Solana, and Luno to reach crypto investors and retail traders. Its landing pages never serve a finished malware file. They send the victim’s browser build instructions and let it assemble the final Windows executable in memory, so every victim gets a differently hashed file.
The original analysis published 96 domain IoCs. Aided by the WhoisXML API MCP Server², we investigated all 96 after confirming none were owned by legitimate entities.
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
String-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Client traffic and typosquatting analysis
- Domain IoC WHOIS and DNS history analysis
- Email-connected domain discovery
- IP and IP-connected domain discovery
- String-connected domain discovery
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://blog.confiant.com/p/sourtrade-browser-assembled-malware
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
DNS Spotlight: BigBear 2.0 PhaaS Targets Span 40+ Countries
WhoisXML API uncovered 1,600+ additional artifacts linked to BigBear 2.0. Download the threat research materials now.
A DNS Investigation of the ASCII Smuggling Phishing Campaign
WhoisXML API uncovered 100+ additional artifacts linked to the ASCII smuggling phishing campaign. Download the threat research materials now.
A DNS Deep Dive into a Silver Fox-Style Fake Installer Campaign
WhoisXML API uncovered 1,500+ additional artifacts linked to a Silver Fox-style fake installer campaign. Download the threat research materials now.