plutonovaflux[.]com

Analysis of the domain plutonovaflux.com indicates it is actively associated with high-risk phishing activity as of July 27, 2026. The domain was registered on December 25, 2025, through Squarespace Domains LLC, a registrar frequently observed in malicious infrastructure due to its accessibility and bulk registration options. Infrastructure analysis reveals the domain resolves to the IP address 163.61.188.2, with nameservers hosted under dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. Lyte Hosting has been previously linked to bulletproof hosting services, which are commonly exploited by threat actors to sustain phishing and malware distribution operations.

Detection data from VirusTotal shows that 4 out of 91 security vendors flag plutonovaflux.com as malicious, a modest but notable detection rate that suggests early-stage identification of phishing behavior. The domain is also listed on one security blocklist and is actively blocked by PhishDestroy, a specialized anti-phishing service. No additional context regarding the specific brand being impersonated or the exact nature of the phishing content is currently available, as the page title and target brand have not been confirmed through available threat intelligence sources. Defenders are advised to treat this domain as hostile.

Network-level blocking of the IP 163.61.188.2 and the domain plutonovaflux.com is recommended for enterprise and consumer security controls. Organizations should monitor for any internal traffic attempting to resolve this domain or communicate with its associated IP, as such activity may indicate compromised endpoints or user interaction with phishing material. Given the domain's recent creation and ongoing activity, further monitoring and updates to detection rules are warranted as additional threat intelligence emerges.