autotrade247[.]pro[.]1stcapitalunion[.]org

Analysis of the domain autotrade247.pro.1stcapitalunion.org, observed on July 24, 2026, indicates that the site was taken offline but retains a measurable threat footprint. The domain was registered on February 21, 2026 through Dynadot Inc and resolves to the IPv4 address 198.251.89.220, which is announced by AS53667 FranTech Solutions and geolocated to the United States. DNS resolution is served by the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. The TLS certificate associated with the host carries an R10 rating, suggesting a low trust score.

The page title returned from the site, "Auto Trade 247 – Safe investment with Auto Trade 247," does not reference the impersonated brand, yet the intelligence profile classifies the campaign as a Google-focused tech-support scam, indicating that the content likely attempts to lure victims by claiming Google support. VirusTotal scanning recorded a single positive detection out of 93 antivirus engines, demonstrating that at least one security product identified malicious characteristics. The domain is listed on one external blocklist and has been actively blocked by the PhishDestroy service, confirming that threat‑intel sharing platforms have flagged the infrastructure. The limited detection count and singular blocklist entry suggest a nascent operation, but the combination of brand impersonation, low‑trust SSL, and a dedicated hosting provider warrants elevated risk assessment.

Uncertainties remain regarding the exact payload delivered, the presence of additional command‑and‑control infrastructure, and whether the site employed credential‑harvesting forms. Defenders should continue to monitor DNS queries for the domain and the associated IP, enforce blocklist rules that include the observed IP range, and consider adding the domain to internal phishing‑prevention feeds.