unrpc[.]top

This domain, unrpc.top, was registered on November 24, 2025, through NiceNIC International Group Co., Limited and is currently offline. Infrastructure analysis reveals it was hosted on Cloudflare IP 188.114.96.3 (AS13335, US) with nameservers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. The domain appears on one security blocklist (PhishDestroy) and is flagged by 3 of 95 security vendors on VirusTotal as malicious. The page title 'Welcome to nginx!' suggests a default server configuration, which may indicate either a hastily deployed phishing kit or a placeholder before full malicious content was loaded.

The domain explicitly impersonates x.com, classified as brand impersonation in available threat intelligence. No SSL certificate was present, increasing the likelihood of interception or detection by network monitoring tools. While the domain is currently offline, defenders should treat any future resolution or DNS changes as high-risk indicators. The combination of Cloudflare hosting, absence of SSL, and minimal detections suggests this infrastructure may have been part of a larger, short-lived campaign.

Organizations should review logs for connections to 188.114.96.3 or DNS queries for unrpc.top, particularly those originating from user devices or internal systems. Given the domain's creation date and current offline status, it may reappear under different hosting or with altered infrastructure. No further details about the phishing kit or specific lure content are available at this time.