rutorforum24[.]to

rutorforum24.to was observed to be taken offline as of the report date. The domain was registered on 16 December 2023 through the Government of the Kingdom of Tonga and is hosted on Cloudflare infrastructure (ASN 13335). DNS resolution points to 188.114.96.3, an IP address located in the United States and associated with Cloudflare, Inc. The site served an HTTP 529 response code, indicating a server overload or timeout condition at the time of testing. TLS handshake succeeded using a certificate issued by Google Trust Services under the WE1 root, confirming the presence of valid HTTPS encryption.

The page title returned by the web server is the literal string “rutorforum24.to”, providing no additional context about the site’s purpose. Security telemetry shows the domain appears on a single blocklist and has been flagged by PhishDestroy. VirusTotal analysis recorded two positive detections out of ninety‑five scanners, suggesting that at least a minority of AV engines consider the host malicious. Technology fingerprinting identified Cloudflare and HTTP/3 support, while the authoritative nameservers are hans.ns.cloudflare.com and kami.ns.cloudflare.com.

The limited detection footprint, combined with the offline status and the presence of a generic page title, prevents a full content‑level assessment; the exact phishing payload or credential‑harvesting mechanisms have not been captured. Defenders should continue to block the domain at perimeter filters, add the IP address 188.114.96.3 to deny lists, and monitor for any re‑registration attempts or related sub‑domains under the same nameservers. Ongoing observation of Cloudflare‑hosted assets linked to this ASN is recommended, as threat actors often leverage shared infrastructure to rotate malicious sites. The current evidence supports an elevated risk rating and justifies proactive mitigation.