verlimtrust[.]com

verlimtrust.com was observed hosting a generic investment phishing page titled “Home - VerlimTrust”. The site was registered on 21 October 2025 through the Ultahost, Inc. registrar and resolved to the IPv4 address 159.100.6.5, which maps to a German hosting facility operated by UltaHost Inc. The authoritative name servers are ns1‑ns4.ultahost.com, confirming the registrar’s infrastructure. The server presented a LiteSpeed web server, delivered a front‑end built with Tailwind CSS, Alpine.js, and third‑party assets from jsDelivr, and negotiated HTTP/3 connections. TLS was provided by a Let’s Encrypt certificate (R12), indicating a valid HTTPS endpoint at the time of testing.

Reputation checks show the domain appears on one public blocklist and is flagged by the PhishDestroy service. VirusTotal scans returned 13 positive detections out of 94 submitted engines, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious classification. The site was taken offline before the July 23 2026 scan, and no live content could be captured; only the page title remains as visible evidence. The listed scam type is “Investment Scam”, though no further details on the lure or targeted victims have been disclosed.

Given the combination of registrar affiliation, hosting location, low trust scores, and multiple vendor detections, defenders should add verlimtrust.com and its resolved IP 159.100.6.5 to blocklists, enforce DNS sink‑hole redirects, and monitor for any re‑registration or resurrection of the domain. Continuous observation of related Ultahost name servers and associated IP ranges is advised, as threat actors often reuse the same infrastructure for subsequent campaigns. At present, the lack of scraped page content limits attribution of specific phishing kits or credential‑harvesting modules, so threat‑intel teams should treat the domain as a high‑confidence indicator of an active investment‑fraud operation and prioritize preventive controls.