plus500ut[.]com

This domain is flagged for elevated-risk brand impersonation targeting Facebook users. Analysis indicates the site masqueraded as a legitimate trading platform (Plus500 US) to harvest credentials or distribute malicious payloads, despite having no affiliation with the actual brand. The impersonation strategy leveraged a deceptive page title (Plus500 US: It’s Trading With A Plus | Plus500) to mislead victims into believing they were interacting with a trusted financial service provider. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain plus500ut.com was registered on June 28, 2025, through NameSilo, LLC, and resolved to IP address 163.61.188.5. It employed Cloudflare as a reverse proxy, obscuring its origin, while utilizing HTTP/3, Google Tag Manager, and Google Analytics for tracking user interactions. Security vendors on VirusTotal flagged the domain with 2/95 detections, and it was assigned a Gridinsoft trust score of 0/100. The domain appeared on one security blocklist and was blocked by PhishDestroy. SSL certification was provided by Google Trust Services, a common tactic to lend false legitimacy to phishing infrastructure. Mitigation steps for this threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Network administrators should block traffic to 163.61.188.5 and monitor for connections to newly registered domains under NameSilo with similar naming patterns. Users should be educated to verify domain authenticity by cross-referencing official brand URLs and checking for SSL certificate discrepancies. Organizations should implement strict email filtering rules to quarantine messages containing links to domains registered within the last 30 days, particularly those impersonating financial or social media platforms. Incident responders should preserve logs of any interactions with this domain for forensic analysis.