automated-trading[.]com[.]tr

Analysis of the domain automated-trading.com.tr indicates it was actively impersonating Google as part of an investment-themed fraud campaign. The domain, registered on November 24, 2024, resolved to the IP address 163.61.188.5, hosted under AS153568 (NEW DHAKA HARDWARE) in the United States. No SSL certificate was present, and the domain relied on nameservers dns1.lytehosting.com through dns4.lytehosting.com for DNS resolution. The page title, 'Automated Swing Trading – Safe investment with Automated Swing Trading,' suggests the site promoted fraudulent investment opportunities under the guise of automated trading services.

While the exact content and functionality of the site remain unanalyzed, the branding aligns with known tactics used to deceive users into financial scams. Detection data from July 2026 shows the domain was flagged by 10 of 95 security vendors on VirusTotal, appeared in one AlienVault OTX threat intelligence pulse, and was listed on at least one security blocklist. Trust scores from Gridinsoft and Scamadviser both rated the domain at 0/100 or 1/100, respectively, further indicating its malicious nature. Infrastructure analysis reveals the domain was taken offline by July 23, 2026, and was blocked by PhishDestroy.

The registrar details are not specified in available intelligence, but the hosting provider's association with a non-standard ASN and the absence of SSL encryption are consistent with low-reputation phishing infrastructure. Defenders should treat this domain as confirmed malicious and monitor for related domains using similar naming conventions or hosting patterns. Additional scrutiny of domains resolving to 163.61.188.5 or utilizing the same nameservers may uncover further campaign activity.