laurent-billionaire[.]com

This domain, laurent-billionaire.com, is currently active and serves as a social‑media phishing infrastructure targeting Instagram users. The site returns HTTP 200 and presents the generic WordPress title “Laurent Billionaire – Just another WordPress site,” indicating a default installation rather than a brand‑specific landing page. The underlying stack includes WordPress, MySQL, PHP, Apache HTTP Server, and front‑end libraries such as UIKit, Swiper, Lightbox, and the Sectigo SSL certificate chain. The TLS certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, confirming the presence of a valid HTTPS endpoint. Domain registration data shows the domain was created on 30 September 2024 via IONOS SE and is served by four UI‑DNS nameservers (ns1017.ui-dns.biz, ns1043.ui-dns.org, ns1083.ui-dns.de, ns1105.ui-dns.com).

DNS resolution points to IP 217.160.0.115, an address owned by AS8560 IONOS SE and located in Germany. The IP has been listed on one security blocklist and is currently blocked by PhishDestroy. Threat intelligence sources corroborate the malicious intent. AlienVault OTX includes the domain in a single pulse, and VirusTotal reports detections by ten of ninety‑five scanning engines. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the classification as high‑risk.

The domain is explicitly tagged as a “Social Media Phishing” campaign that impersonates Instagram, although the publicly visible page content has not been captured in this report. Defenders should treat laurent-billionaire.com as a confirmed phishing host. Recommended mitigations include adding the domain and its associated IP address to network‑level blocklists, updating URL filtering policies, and monitoring for any new sub‑domains or DNS changes. Continuous re‑evaluation is advised, as the infrastructure may evolve or host additional credential‑harvesting pages.