rpcuni[.]top

Analysis of the domain rpcuni.top indicates active brand impersonation targeting X.com (formerly Twitter) users. Registered on November 24, 2025, through NiceNIC International Group Co., Limited, the domain currently resolves to IP address 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335). The site returns an HTTP 308 redirect status, though the final destination remains unconfirmed as the exact content has not yet been analyzed beyond the observed 'Welcome to nginx!' page title. SSL certification is provided by Google Trust Services (WE1), a common feature in both legitimate and malicious sites. Infrastructure review shows Cloudflare nameservers (harlan.ns.cloudflare.com and lisa.ns.cloudflare.com) and HTTP/3 protocol usage, consistent with modern phishing campaigns leveraging CDN services to obscure origin servers. The domain appears on at least one security blocklist and is flagged by 4 of 95 vendors in VirusTotal scans, though this detection rate alone does not confirm malicious intent. AlienVault OTX records associate rpcuni.top with 24 threat intelligence pulses, suggesting prior identification in phishing or fraud-related activities. Defenders should note the domain's registration age (7.5 months) and persistent activity despite blocklisting by MetaMask, PhishDestroy, and SEAL. The combination of brand impersonation targeting, Cloudflare hosting, and low Gridinsoft trust score (0/100) warrants immediate blocking at network and endpoint levels. Organizations should monitor for credential submission attempts or redirect chains leading to this domain, particularly in campaigns mimicking X.com authentication flows. Further analysis of the redirect target and any associated JavaScript or form handlers is recommended to determine the full scope of the threat.