usual-money[.]click

Analysis indicates that the domain usual-money.click resolves to the IPv4 address 92.113.16.177, which is hosted by Hostinger International Limited (AS47583) in Germany. The registration was performed through Hostinger operations, UAB on 13 December 2025, and the domain is served by the generic parking name servers ns1.dns-parking.com and ns2.dns-parking.com. No TLS certificate is presented, meaning the site is only reachable over HTTP. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single security blocklist.

VirusTotal reports that 15 of 95 scanning engines flag the domain as malicious, confirming a consensus of threat detection across multiple vendors. The page title retrieved from the site reads “Usual (USUAL) Builds Momentum Ahead Of Potential Breakout: What’s Next?”, which does not correspond to a legitimate brand or service and is consistent with a generic phishing lure. The site has been reported to and blocked by PhishDestroy and is currently taken offline, indicating that active mitigation has been applied. However, the underlying infrastructure—public IP, hosting provider, and lack of TLS—remains usable for future malicious deployments.

Defenders should add the resolved IP address 92.113.16.177 to network blocklists, monitor DNS queries for the domain and its parking name servers, and enforce HTTPS‑only policies to prevent accidental connections. Threat intelligence feeds should be updated to reflect the 15 vendor detections and the low trust score, and any endpoint protection solutions should be configured to flag URLs matching the observed page title pattern. Continuous re‑scanning of the domain is advised in case the site is re‑hosted, and organizations should educate users about unsolicited messages that reference “Usual” or similar financial‑sounding terms.