support[.]myrocketxpress[.]com

The domain support.myrocketxpress.com is currently active and classified as a high‑risk brand‑impersonation site. Infrastructure analysis shows the host resolves to IP 103.30.72.102, which belongs to AS134330 Sst Infotech India Private Limited in India. The server runs Ubuntu with Nginx and the Inertia.js framework, and presents a valid Let’s Encrypt R13 TLS certificate. DNS is served by Cloudflare (clay.ns.cloudflare.com, tani.ns.cloudflare.com). The domain was registered on 2024‑03‑02 through Realtime Register B.V. and returns an HTTP 302 redirect. Threat intelligence indicates the site impersonates the brand “base” and is associated with a cryptocurrency‑drain scam. It has been flagged by one blocklist, receives a Gridinsoft trust score of 0/100, and is listed in PhishDestroy’s blocklist. VirusTotal reports a single vendor detection out of 95 scanners. The page title returned is “Home”, but no further content analysis is available. Defenders should treat any traffic to this domain as malicious, enforce network‑level blocking, and add the domain to endpoint and email filtering rules. Continuous monitoring of DNS queries for the associated IP and Cloudflare nameservers is recommended to detect possible re‑use or pivoting. Because the site’s payload and user‑interaction details are unknown, additional sandboxing of any downloaded artifacts or redirected URLs is advised to uncover potential malware or credential‑harvesting mechanisms.