equinoxnudgecun[.]com

This domain, equinoxnudgecun.com, is currently classified as a high‑risk generic phishing site targeting users of Cipher Sage Credit Union. The site was registered on 2025-06-09 through Atak Domain and is hosted on nameservers dns1.lytehosting.com through dns4.lytehosting.com. It presents a valid Let’s Encrypt certificate (R13) and returns HTTP 200 responses, indicating an operational web server.

Technical analysis shows the domain resolves to IP 163.61.188.222, which is geolocated to the United States and belongs to ASN 153568 (NEW DHAKA HARDWARE). The web server runs LiteSpeed and incorporates third‑party components such as Google Maps, Bootstrap, Weglot, SweetAlert, Smartsupp, OWL Carousel, and Lightbox. The site has been blocked by PhishDestroy and appears on a single security blocklist. VirusTotal scans report 5 of 95 security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100.

Publicly available evidence is limited to the page title “Cipher Sage Credit Union”; the actual page content, login forms, or credential‑harvesting mechanisms have not been disclosed in the available intelligence. Consequently, the precise lure and data‑exfiltration tactics remain uncertain, though the classification as generic phishing suggests a broad credential‑stealing campaign.

Defenders should immediately add equinoxnudgecun.com to URL filtering and DNS block lists, and consider blocking the associated IP address 163.61.188.222 as a precaution. Monitoring for outbound connections to this host and for similar domains using the same nameserver set is advised. Updating intrusion detection signatures to flag the identified third‑party libraries may aid in early detection of related malicious pages. Continuous re‑evaluation of VirusTotal and other threat feeds is recommended to capture any escalation in detection rates.