rostitutki[.]to

rostitutki.to is currently listed as active in threat intel and is hosted on Cloudflare infrastructure, indicated by its authoritative nameservers amos.ns.cloudflare.com and cecelia.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.96.3, which is associated with a Cloudflare edge node. An HTTP request to the domain returns a 301 redirect response, suggesting that the site is forwarding traffic to another location, a common technique used by phishing operators to hide the final landing page. The domain was registered through Namecheap, a registrar frequently observed in malicious deployments, and its registration details have not been publicly altered to obscure ownership.

VirusTotal records show that 12 of 91 scanned security vendors have flagged the domain as malicious, providing independent corroboration of its threat status. The domain is already listed on at least one external security blocklist and has been added to the PhishDestroy blocklist, indicating that some network defenses are already aware of its activity. The lack of publicly available SSL certificate information means that TLS inspection may be required to verify the certificate presented after the redirect. No page title or brand targeting data have been released, so the phishing campaign likely employs a generic credential‑harvesting approach.

The presence of Cloudflare nameservers does not preclude the use of additional backend servers, which could be provisioned on demand to evade takedown. Defenders should add rostitutki.to and its IP 188.114.96.3 to DNS and URL filtering rules, enforce existing blocklist entries across perimeter and endpoint solutions, monitor Cloudflare DNS logs for anomalous query spikes, and share the indicator set with threat‑sharing platforms to improve community visibility. Continuous re‑scanning on multi‑vendor services such as VirusTotal is recommended to capture any changes in detection posture.