cksrpc[.]top

cksrpc.top was registered through NiceNIC International Group Co., Limited on 26 November 2025. The domain resolves to the IPv4 address 64.52.80.25, which is assigned to AS399629 (BL Networks) and geolocated to the United States. Authoritative name servers are ns1.blnwx.com, ns2.blnwx.com, ns3.blnwx.com, and ns4.blnwx.com. No TLS certificate is presented; HTTP responses return the generic title “Welcome to nginx!”.

The site is currently taken offline, but historical observations indicate it was used for brand impersonation of x.com. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain as malicious, and it appears on two public blocklists, specifically PhishDestroy and ScamSniffer. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The lack of SSL, combined with the generic server header, suggests a low‑cost hosting setup typical of short‑lived impersonation campaigns.

Because the infrastructure points to a single IP address under BL Networks, defenders should consider blocking the address 64.52.80.25 and the associated name servers at the network perimeter. Monitoring for newly registered domains that use the same registrar or similar name‑server patterns may help detect future replicas. Threat intelligence consumers are advised to add cksrpc.top to internal blocklists, enforce URL filtering for the x.com brand, and continue to validate any inbound traffic to the identified IP against reputable reputation services. The limited detection footprint—only two blocklists and modest vendor flagging—highlights the importance of proactive controls, as the domain could be re‑activated or leveraged in a new campaign without further public notice.