app-prod[.]rustplus[.]store

Analysis of the domain app-prod.rustplus.store, observed on July 20, 2026, indicates that it is currently active and associated with a generic phishing campaign. DNS queries return no authoritative nameserver records, which suggests the domain is either using opaque DNS services or the nameserver information is deliberately concealed. The domain resolves to the IP address 172.67.168.190, an address known to belong to Cloudflare’s edge network. Use of a Cloudflare front‑end can obscure the true hosting location and is a common technique in phishing infrastructure. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy sink‑hole service, confirming that at least one defensive platform has identified it as malicious. VirusTotal has processed the domain with scans from 95 independent vendors; none of the scanners reported a detection at the time of analysis. While the lack of detections does not constitute evidence of benign behavior, it does indicate that automated signatures have not yet flagged the site. No additional intelligence such as registrar details, SSL certificate metadata, HTTP response codes, Safe Browsing status, or page title has been published in the current dataset, limiting the depth of technical attribution. Consequently, the precise phishing payload, targeted brand, or credential‑harvesting page remains unknown. Given the observable indicators—absence of nameserver records, Cloudflare IP resolution, inclusion on a security blocklist, and active blocking by PhishDestroy—defenders should treat the domain as high‑risk. Recommended mitigations include adding the domain to DNS‑based blocklists, configuring web proxies to deny outbound connections to the IP range, and monitoring network traffic for any attempts to resolve or contact the domain.