twpkfbbcwuqrlttc[.]deuthme[.]info

The domain twpkfbbcwuqrlttc.deuthme.info has been identified as a redirection-based phishing infrastructure, designed to surreptitiously forward visitors to malicious endpoints. Analysis indicates this domain does not directly host phishing content but instead acts as an intermediary, likely to obfuscate the final destination and evade detection. Currently, the domain is offline, though its prior activity and infrastructure warrant continued scrutiny. Technical indicators reveal the domain was flagged by 6 of 95 security vendors on VirusTotal, reflecting elevated suspicion within the threat intelligence community. It is registered through Dynadot Inc, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 172.67.141.60, a Cloudflare-assigned endpoint, and employs Nginx as its web server alongside Cloudflare Browser Insights for performance monitoring. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on two security blocklists, including PhishDestroy and OISD. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious infrastructure. While the domain is currently offline, its prior configuration and detection history suggest a deliberate attempt to bypass security controls. Organizations are advised to block the domain and its resolved IP at the network perimeter, update endpoint protection rules to include this indicator, and monitor for any resurgence or related infrastructure. Security teams should review logs for prior connections to this domain, particularly in environments where redirection-based attacks are prevalent. Proactive measures, such as implementing DNS-based filtering and educating users on recognizing redirection tactics, are recommended to mitigate future exposure.