ckserv[.]top

ckserv.top was registered on 26 November 2025 through NiceNIC International Group Co., Limited. The domain resolves to IP 64.52.80.25, an address owned by AS399629 BL Networks and geolocated to the United States. DNS resolution uses Cloudflare name servers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. No TLS certificate was presented, and an HTTP request returned the default nginx server banner with the page title “Welcome to nginx!”.

The site was identified as a brand‑impersonation campaign targeting x.com, and it has been classified as a “Brand Impersonation” scam type. PhishDestroy has taken the domain offline, and it currently appears on a single security blocklist. Independent reputation services have assigned a Gridinsoft trust score of 0 out of 100, indicating maximal risk. VirusTotal scans recorded three positive detections out of ninety‑five AV engines, confirming malicious behavior.

The limited detection footprint suggests a short‑lived operation, but the use of reputable cloud name servers and a public IP range associated with BL Networks indicates a disposable infrastructure that can be quickly re‑hosted. Defenders should continue to block the domain and the associated IP address at perimeter filters, add the domain to internal phishing blocklists, and monitor the AS for any new registrations that reuse the same name servers or IP range. Because the site is already offline, incident response focus should shift to detection of any follow‑up campaigns that reference the same brand target (x.com) or that attempt to replicate the same hosting configuration. Ongoing telemetry from threat‑intel feeds, including updates from PhishDestroy and VirusTotal, should be incorporated into security information and event management (SIEM) rules to flag future attempts that match this indicator set.