sarukun[.]net

Analysis indicates that sarukun.net is currently active and serves content over HTTPS with a valid Let's Encrypt certificate. The domain resolves to IP 183.90.245.29, which is hosted by XSERVER Inc. in Japan and uses the provider's default nameservers (ns1‑ns5.xserver.jp). The site returns HTTP 200 and its page title is the Japanese phrase “いいねがいっぱい！” (translation: “Lots of likes!”). Threat intelligence sources list the domain in a single AlienVault OTX pulse and on one public blocklist; PhishDestroy also classifies it as malicious. VirusTotal scans show seven of ninety‑one scanners flagging the host, reinforcing the suspicion. MX records are present but point to the same domain, a pattern often observed in phishing infrastructure. No additional infrastructure such as CDN, C2, or redirect chains has been observed. Because the site is publicly reachable, defenders should block DNS resolution for sarukun.net, enforce TLS inspection to capture any credential traffic, and monitor outbound connections to 183.90.245.29. Continuous re‑evaluation is advised, as further payloads or credential‑harvesting pages may be deployed without notice.