prot-app[.]top

The domain prot-app.top was registered on December 06, 2025 through NiceNIC International Group Co., Limited and resolves to the IP address 172.67.188.186, which belongs to AS13335 Cloudflare, Inc. in the United States. The hosting infrastructure is identified as Cloudflare and the service supports HTTP/3, indicating a modern delivery stack. DNS resolution is served by the authoritative nameservers coleman.ns.cloudflare.com and rayne.ns.cloudflare.com. An SSL certificate issued by Google Trust Services under the label WE1 is present, suggesting the site can serve HTTPS traffic with a trusted root.

When accessed, the server returned the generic page title "Welcome to nginx!", a default response that provides no insight into the site’s content or purpose. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows that three of ninety‑five scanned security vendors flagged the domain, confirming a modest level of detection across the community. The domain is classified as a brand impersonation targeting x.com, though no further artifact such as login pages or credential‑stealing forms has been observed.

Current operational status is offline, limiting immediate threat execution but leaving the infrastructure in place for potential future activation. Defenders should continue to enforce blocking of the domain and its associated IP range, monitor for any re‑appearance of active services, and incorporate the domain into detection rules that flag brand‑impersonation patterns. Ongoing intelligence collection, including periodic VirusTotal rescans and content inspection if the site becomes reachable, is advised to assess whether the infrastructure evolves into an active phishing campaign.