tycku[.]vip

The domain tycku.vip is currently active and has been identified as a high‑risk brand‑impersonation site targeting the x.com brand. The site returns HTTP 200 and presents the page title echoh5.moex.com.pl, which does not match the advertised brand and suggests a deceptive landing page. Risk level is marked high, and the domain is listed on three security blocklists.

Infrastructure analysis shows the domain was registered on June 12 2025 through NameSilo, LLC and is hosted on IP 38.47.227.240, an address allocated to AS137535 JT TELECOM INTERNATIONAL PTE.LTD. in Singapore. Authoritative nameservers are julissa.ns.cloudflare.com and tom.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The web server runs Nginx with HTTP/3 enabled, and the front‑end stack includes Vue.js, Axios, and HSTS.

Detection data indicates three of ninety‑five VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, reflecting a lack of reputable activity. The domain appears on blocklists operated by PhishDestroy, MetaMask, and SEAL. No additional payloads, credential‑stealing forms, or malicious binaries have been observed in the publicly available page source, leaving the exact phishing methodology uncertain.

Defenders should add tycku.vip to network and email filtering rules to prevent user access, and consider DNS sinkholing or URL‑filtering policies that block the associated IP address. Continuous monitoring of the domain’s DNS records and any changes to its content is advised, as the threat actor may later deploy credential‑collection pages. Sharing this indicator with threat‑intelligence platforms will aid broader community mitigation.