ranto[.]store

Analysis of ranto.store indicates a confirmed phishing infrastructure designed to redirect victims to malicious endpoints, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to IP address 68.65.122.222, hosted on Namecheap’s AS22612 network in the United States. Infrastructure analysis reveals the use of Nginx with OpenResty, a common configuration for managing high-volume redirects or proxy-based attacks. The SSL certificate is issued by Let’s Encrypt (R13), a legitimate but frequently abused certificate authority in phishing operations, providing HTTPS encryption without domain validation beyond basic ownership.

The domain is flagged by two of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The page title 'Redirecting...' aligns with observed behavior in redirect-based phishing schemes, where victims are silently forwarded to credential-harvesting pages or malware distribution sites. No brand or specific scam type is identified in the available metadata, though the redirect pattern suggests a generic phishing campaign rather than a targeted brand impersonation. Nameservers point to dns101.registrar-servers.com and dns102.registrar-servers.com, consistent with Namecheap’s default DNS infrastructure.

The Gridinsoft trust score of 0/100 further corroborates the domain’s malicious classification. While the domain is currently offline, defenders should treat it as a confirmed threat vector. Network-level blocking of 68.65.122.222 and monitoring for re-registration or DNS changes is recommended. Additional scrutiny of domains registered through NameCheap with similar creation dates and redirect behavior may uncover related phishing clusters.