worker6[.]noir-api[.]icu

The domain worker6.noir-api.icu has been assessed as an elevated risk due to its specific threat type of brand impersonation. This domain poses a significant threat by mimicking the official x.com website, potentially leading to user data compromise and financial loss.

Infrastructure analysis reveals that worker6.noir-api.icu is registered through Web Commerce Communications Limited. The domain resolves to the IP address 91.92.242.155 and was created on May 10, 2025. Analysis indicates that the domain appears on one security blocklist and is blocked by PhishDestroy. The Gridinsoft trust score for this domain is 0/100, indicating a complete lack of trust. VirusTotal flags this domain with 12 out of 95 security vendors, suggesting a moderate level of recognition as a malicious entity. The page title found when visiting the domain is 'Welcome to nginx!', which is a default Nginx welcome page, often used by threat actors to mask the true nature of their infrastructure. The technologies detected on this domain include Ubuntu and Nginx.

To mitigate the risks associated with brand impersonation, it is recommended that organizations and individuals take the following steps: implement domain monitoring to detect and block any suspicious domains that mimic official websites, educate users about the dangers of brand impersonation and how to verify the authenticity of web pages, and use multi-factor authentication (MFA) to protect user accounts. Additionally, network administrators should configure firewalls and security appliances to block traffic to the identified IP address 91.92.242.155 and ensure that security policies are updated to include this domain in their threat intelligence feeds.