buycertificatesonline[.]com

Analysis indicates that the domain buycertificatesonline.com was registered on April 09, 2025 through Ultahost, Inc. The authoritative name servers are ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com, and DNS resolution points to the IPv4 address 192.142.10.5. The domain appears on a single security blocklist and is currently listed by PhishDestroy, confirming that at least one reputable anti‑phishing feed has flagged it. VirusTotal has recorded 91 vendor scans, none of which returned a detection; however, the absence of detections does not constitute a safety guarantee.

No public safe‑browsing, OTX, or additional reputation data are available for this host. The site’s content has not been captured, so page title, SSL certificate details, HTTP response codes, and any brand‑specific lures remain unknown. The infrastructure suggests a low‑cost hosting arrangement typical of many short‑lived phishing campaigns, and the relatively recent registration date aligns with the observed active status.

Defenders should consider adding the domain to outbound and inbound filtering rules, especially for traffic that may involve certificate‑related services, and continue to monitor for any emerging detections in feed sources. Periodic re‑scans with sandbox services are recommended to capture any payloads that may be delivered if the site becomes active. Network‑level controls that block resolution to 192.142.10.5 or that enforce strict TLS inspection can further reduce exposure while the domain remains under investigation.