rpunic[.]top

Analysis of the domain rpunic.top shows that it was registered on November 24, 2025 through NiceNIC International Group Co., Limited and is delegated to the Cloudflare nameservers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. The domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, and an HTTP request returns the default page title "Welcome to nginx!", indicating that the site is serving a bare nginx instance rather than a customized phishing page at the time of observation.

The domain has been listed on a single public blocklist and is actively blocked by the PhishDestroy service, confirming that security operators have identified it as malicious. VirusTotal scans have recorded four detections out of ninety‑five submitted scanners, providing additional vendor corroboration of its malicious nature. As of the report date, July 24, 2026, the domain status is reported as offline, suggesting that the operator has taken the site down or is rotating infrastructure.

Uncertainty remains regarding the specific credential collection techniques employed, the target brand or service, and whether the domain will be reactivated on a different host. Defenders should continue to block rpunic.top at DNS and proxy layers, monitor the associated IP range for new domains pointing to the same Cloudflare edge, and consider adding the domain to internal deny lists. Ongoing vigilance is advised because the use of Cloudflare's shared infrastructure can facilitate rapid redeployment of similar phishing sites under new domain names.