ns2[.]cloudns[.]to

ns2.cloudns.to is a subdomain of cloudns.to. PhishDestroy first observed the hostname on Dec 5, 2025. The captured page title is “404 Not Found”. Current evidence score: 100/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and Spamhaus DBL. VirusTotal recorded 14 detections among 91 engines: BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, LevelBlue, Lionic, Sophos, VIPRE, Webroot on Aug 1, 2026 at 02:41 UTC. Spamhaus DBL: DBL_PHISH on Jul 14, 2026 at 14:36 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:31 UTC.

The collector marked the hostname reachable on Aug 7, 2026 at 22:14 UTC, but did not retain the HTTP response code. The cloaking probe recorded status split conditional delivery at 2/100 on Aug 7, 2026 at 02:30 UTC: timeout: raw=timeout; http=0; via=http_proxy; error=HTTPConnectionPool(host='152.232.4.98', port=8269): Read timed out. (read timeout=7). Registration records for the registrable domain cloudns.to list Government of Kingdom of Tonga as the registrar and Aug 29, 2025 as the creation date. At collection time, the hostname resolved to 213.209.129.90 on AS214943 (RAILNET Railnet LLC, US). The recorded endpoint location is Hopel, NL. The stored server header is openresty. DOM analysis on Apr 23, 2026 at 11:21 UTC returned 100/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 2 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.