ns1[.]cloudns[.]to

The domain ns1.cloudns.to was created on August 29, 2025 and is currently listed as offline. Registration records indicate the domain was obtained through the Government of the Kingdom of Tonga, suggesting a potentially legitimate registrar front but providing no direct evidence of malicious intent. The domain resolves to the IPv4 address 78.159.156.221, which is mapped to the Netherlands and is owned by AS25211 Euro Crypt EOOD, a hosting operator known for providing services to a range of unrelated customers. No SSL certificate is present on the host, and an HTTP request returns a 404 Not Found page title, confirming that no active payload is being served at the time of observation.

Infrastructure analysis reveals the domain is served by the authoritative nameservers ns1.cloudns.to and ns2.cloudns.to, both belonging to the CloudNS service, a widely used DNS provider. Reputation metrics show a Gridinsoft trust score of 0 out of 100, indicating an extremely low confidence rating. The domain appears on a single security blocklist and has been flagged by the PhishDestroy blocklist, confirming that at least one anti‑phishing organization has identified it as malicious. VirusTotal scans report that 14 of 95 security vendors have flagged the domain, providing independent corroboration of suspicious activity.

The risk level is elevated, and the current status is offline, which may be a temporary takedown or a defensive response. Defensive practitioners should continue to monitor the IP address 78.159.156.221 for any re‑activation, enforce network‑level blocking of the domain and its associated IP, and include the domain in threat‑intel feeds. Because the site currently returns a 404 response, further content analysis is not possible; however, the combination of registrar anomalies, low trust score, blocklist presence, and multiple vendor detections warrants ongoing vigilance.