pluss-500[.]sbs

Analysis of the domain pluss-500.sbs indicates it is an active phishing infrastructure targeting online trading platforms. The domain was registered on July 17, 2026, through NameSilo, LLC, and currently resolves to the IP address 188.114.96.3. Infrastructure analysis reveals Cloudflare nameservers (aleena.ns.cloudflare.com and buck.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The domain appears on one security blocklist, specifically PhishDestroy, which has flagged it as malicious.

While VirusTotal scans from 91 vendors show no current detections, this absence does not confirm safety, as phishing domains often evade initial detection during the early stages of deployment. The domain remains active as of July 23, 2026, with no evidence of suspension or sinkholing. No specific brand or trading platform has been confirmed as the target based on available data, though the domain name suggests an attempt to mimic legitimate financial services. Defenders should treat this domain as high-risk and prioritize monitoring for connections from corporate or user endpoints.

Network-level blocking is recommended, particularly for organizations in the financial or trading sectors. Further investigation is required to determine the exact phishing kit in use, the targeted brand, and any associated command-and-control infrastructure. Given the recent registration and active status, this domain is likely part of a broader campaign, and defenders should correlate logs for related indicators such as the resolved IP or Cloudflare nameserver usage.