towns[.]us[.]com

The domain towns.us.com is currently flagged as a high‑risk generic phishing site. Its HTTP response returns a 403 status code and the page title is limited to “Just a moment…”. The domain was registered on 21 February 2026 through Instra Corporation Pty Ltd. and remains active as of the report date, 12 July 2026. Infrastructure analysis shows the domain resolves to the IPv4 address 104.21.2.137, which is hosted in Canada by a large content‑delivery provider. The authoritative name servers are ns1.centralnic.net through ns4.centralnic.net, indicating use of the CentralNic registry platform. The TLS certificate presented is issued by a widely‑trusted certificate authority under the Google Trust Services umbrella, using the WE1 intermediate. Reputation data indicates the domain appears on two independent security blocklists, specifically PhishDestroy and ScamSniffer. VirusTotal scans have resulted in 2 out of 95 security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. These signals, combined with the high‑risk classification, support a strong confidence level that the domain is being leveraged for phishing activities. Defenders should block traffic to towns.us.com at network perimeter and proxy layers, and add the associated IP address 104.21.2.137 to deny lists. Continuous monitoring of the domain’s DNS records and any changes to its TLS certificate is advised. Since the site currently returns a 403 response, automated crawling may be limited, but threat‑intel feeds should be updated to reflect the domain’s presence on known blocklists.