l2web[.]top

Analysis of l2web.top, created on 11 December 2025 and hosted behind Cloudflare (AS13335, US), shows several indicators of malicious infrastructure. The domain resolves to 172.67.197.242, uses Cloudflare’s DNS (emerson.ns.cloudflare.com, nelly.ns.cloudflare.com) and serves an HTTPS certificate issued by Google Trust Services under the WE1 root, confirming a valid TLS chain. HTTP requests return a 301 redirect and the final page title reports “522: Connection timed out”, suggesting the backend server is unreachable or deliberately failing to load content. The site is flagged by four of ninety‑five VirusTotal scanners, and appears on a single external blocklist where PhishDestroy has recorded it as active.

The Gridinsoft trust score of 0 out of 100 further reflects a reputation of zero. Registration information lists NiceNIC International Group Co., Limited as the registrar, with no privacy protection. The observed phishing kit is identified as an “Airdrop Scam”, indicating the domain is being used to lure victims with fraudulent cryptocurrency airdrop promises. While the redirect and timeout page limit immediate content analysis, the combination of low trust score, multiple vendor detections, blocklist inclusion, and known phishing kit strongly suggest a high‑risk phishing operation.

Defenders should add l2web.top to deny‑list rules, monitor DNS queries for the domain and its associated Cloudflare nameservers, and block any outbound connections to the resolved IP. Users should be warned that any communications referencing l2web.top are likely malicious, and organizations should enforce email and web filtering policies that reference the identified indicators. Continuous re‑evaluation is advised in case the backend becomes accessible and reveals additional payloads.