com-522161[.]help

Analysis of the domain com-522161.help, observed as offline on July 25, 2026, shows multiple indicators consistent with a brand impersonation campaign targeting the x.com brand. The domain was registered through NameSilo, LLC and created on November 30, 2025. It resolves to IP address 172.67.151.207, which belongs to AS13335 Cloudflare, Inc., placing the hosting infrastructure in the United States. No TLS certificate is presented, and the HTTP response returns a default nginx page with the title "Welcome to nginx!", offering no evidence of a legitimate site front end. The domain’s nameservers are achiel.ns.cloudflare.com and magali.ns.cloudflare.com, both Cloudflare‑managed, reinforcing the use of a common CDN for rapid deployment.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a highly suspicious profile. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Threat intelligence from AlienVault OTX references the domain in one pulse, confirming its recognition by the broader security community. VirusTotal analysis shows that seven of ninety‑five scanning engines flag the domain as malicious, providing additional corroboration of its abusive nature.

The listed scam type is "Brand Impersonation" with the specific target identified as x.com. While the site is currently offline, the observed infrastructure elements—Cloudflare hosting, absence of SSL, low trust score, and multiple vendor detections—suggest a deliberately crafted impersonation effort. Defenders should continue to block the domain at network perimeters, monitor for any re‑activation, and incorporate the IP address and associated nameservers into threat‑intel feeds. Further investigation should focus on any related subdomains or similar registrations that share the same registrar or hosting provider, as adversaries often reuse these components across campaigns.