bt-service[.]plutio[.]com

This domain presents an elevated risk level due to confirmed brand impersonation specifically targeting Google. Analysis indicates the domain is designed to deceive users by mimicking a legitimate Google service interface, leveraging the domain structure bt-service.plutio.com to appear authentic. The threat type is brand impersonation, a sophisticated form of phishing that exploits trust in well-known corporate brands to harvest credentials or install malware.

Technical indicators are extensive and confirm malicious intent. VirusTotal reports 6 out of 95 security vendors flagging this domain as malicious. The domain is registered through NameCheap, Inc., resolves to IP address 104.21.8.24, and was created on October 26, 2015. It appears on 3 security blocklists including PhishDestroy, PhishingDB, and OISD. Trust scores are critically low: Gridinsoft rates it 0/100 and Scamadviser rates it 1/100. Infrastructure analysis reveals technologies including Node.js, Google Cloud, Express, Google Tag Manager, Google Cloud CDN, Google Analytics, FirstPromoter, and Cloudflare. The SSL certificate is issued by Google Trust Services, and the page title found was Plutio. The domain is currently offline.

Mitigation steps specific to brand impersonation targeting Google include immediately blocking access to bt-service.plutio.com across all network perimeters. Security teams should review web proxy logs for any connections to this domain or its associated IP 104.21.8.24. Users who may have visited the site should be instructed to change their Google account passwords and enable multi-factor authentication. Organizations should add this domain to their threat intelligence feeds and monitor for similar domain patterns using the seed identifier 0e9442. Given the low trust scores and high vendor flagging rate, this domain should remain permanently blocked even if it comes back online.