com-warm-hub[.]pro

Analysis of the domain com-warm-hub.pro shows a newly registered site that has been taken offline but retains evidence of malicious intent. The domain was created on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is serviced by the Cloudflare nameservers jeff.ns.cloudflare.com and paige.ns.cloudflare.com. DNS resolution points to the IP address 104.21.54.130, which belongs to the Cloudflare network (AS13335) and is geolocated to the United States. No TLS certificate was observed, and an HTTP request returns the default “Welcome to nginx!” page title, indicating that the web server is delivering a generic placeholder rather than a branded login portal. The site is listed on three independent blocklists—PhishDestroy, MetaMask, and SEAL—and appears on three security blocklists overall.

VirusTotal scans report that four of ninety‑three antivirus and URL‑reputation engines flagged the domain, suggesting that at least a minority of scanners recognize it as suspicious. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low confidence in the domain’s legitimacy. The primary malicious indicator is the explicit branding claim: the domain is categorized as a brand‑impersonation campaign targeting x.com. No further technical artifacts such as phishing kits, credential‑harvesting forms, or malicious payloads have been publicly disclosed, and the site’s current offline status prevents direct observation of any page content beyond the generic nginx title. Consequently, the exact methodology of the impersonation—whether a clone of x.com’s login page or a redirect to a credential‑stealing endpoint—remains unknown.

Defenders should treat com-warm-hub.pro as hostile infrastructure.