urpcni[.]top

Analysis of urpcni.top, observed on July 24, 2026, indicates that the domain is being used for a brand impersonation campaign targeting the x.com brand. The domain was registered on November 26, 2025 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 45.61.136.23, which is assigned to AS399629 (BL Networks) in the United States. The authoritative name servers for the zone are ns1.blnwx.com, ns2.blnwx.com, ns3.blnwx.com, and ns4.blnwx.com, suggesting the hosting infrastructure is provided by the same network operator. An HTTP request to the domain returns a 200 status code and a default page titled “Welcome to nginx!”, confirming that a web server is reachable but no malicious landing page content has been captured.

The TLS certificate presented by the server is issued to “PhishDestroy / botadmin.destroy.tools”, a known phishing‑related entity, and the certificate chain validates without error, indicating intentional use of a phishing‑associated certificate. VirusTotal scans show that three of ninety‑five security vendors have flagged the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of abuse. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service. The overall risk rating has been set to elevated, and the current operational status is offline, meaning the site is no longer reachable at the time of analysis.

While the visible content is limited to a generic nginx welcome page, the combination of registrar information, hosting details, low trust score, vendor detections, and the phishing‑related certificate strongly supports the conclusion that urpcni.top was deployed to impersonate x.com. Defenders should ensure that any outbound connections to the IP address 45.61.136.23 are blocked, add the domain and its associated IP to local deny lists, and monitor for any future re‑registration attempts.