v1-pnc-dex[.]top

The domain v1-pnc-dex.top was registered on December 5, 2025 through NiceNIC International Group Co., Limited and is currently reported as offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2606:4700:3035::ac43:a2ad, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative name servers are harlan.ns.cloudflare.com and lisa.ns.cloudflare.com, confirming the use of Cloudflare's DNS service. A TLS certificate issued by Google Trust Services under the WE1 label is present, and the server advertises HTTP/3 support, suggesting a modern web stack.

The only visible page element is the title "Welcome to nginx!", indicating that the underlying web server is Nginx, but no further content has been disclosed. The domain is flagged as impersonating the brand x.com, aligning with the supplied brand target. Detection activity includes six of ninety‑five security vendors on VirusTotal marking the domain as malicious, and the domain appears on a single public security blocklist. It has also been identified in one AlienVault OTX threat‑intel pulse.

Defensive services have taken action: PhishDestroy has blocked the domain, and the presence on blocklists suggests that browser and email filters may already be rejecting traffic to it. While the offline status limits immediate threat exposure, the combination of active Cloudflare hosting, a valid SSL certificate, and confirmed malicious detections indicates an intent to host phishing or impersonation content. Defenders should continue to monitor the domain for any re‑activation, ensure that any inbound or outbound traffic to the associated IP address is blocked at the network perimeter, and update threat‑intel feeds to include the domain, its IP, and associated name servers. Additional scrutiny of related subdomains or similarly structured domains registered by the same registrar may be warranted, given the recent creation date and observed impersonation pattern.