ns2[.]cloudns[.]to

This domain, ns2.cloudns.to, is identified as a phishing-related nameserver infrastructure with elevated risk indicators. Analysis indicates the domain is currently offline, returning a 404 Not Found HTTP status, which may suggest recent takedown efforts or temporary suspension. The domain was registered on August 29, 2025, through the Government of the Kingdom of Tonga, a registrar occasionally associated with high-risk or abused domains. It resolves to the IP address 213.209.129.90, hosted on AS208185 (Net Gate Telecom S.R.L.) in the Netherlands, a network segment previously linked to malicious activity.

Security vendor assessments reinforce the elevated risk classification: Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist, specifically PhishDestroy. While 12 of 95 security vendors on VirusTotal flagged the domain as malicious, this detection rate alone does not confirm the exact nature of the threat. No SSL certificate is present, which is atypical for legitimate infrastructure and may indicate a lack of basic security measures or an attempt to evade encrypted traffic inspection. The domain functions as a nameserver (ns1.cloudns.to and ns2.cloudns.to), suggesting its role in supporting broader phishing or malicious campaigns rather than hosting direct content.

Defenders should treat this infrastructure as compromised and prioritize monitoring or blocking resolutions from these nameservers. Given the absence of an SSL certificate, HTTP traffic from domains using these nameservers should be scrutinized for anomalous patterns. While the exact phishing target or campaign remains unconfirmed due to the lack of visible content, the infrastructure’s association with known malicious indicators warrants immediate defensive action, including DNS sinkholing or firewall rules to prevent resolution through these nameservers.