rutor24x7[.]to

The domain rutor24x7.to was registered on 16 December 2023 through a registrar listed as the Government of the Kingdom of Tonga. The site currently resolves to the Cloudflare address 172.67.69.69, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. An SSL certificate issued by Google Trust Services under the WE1 label is present, indicating that TLS is correctly negotiated. HTTP requests return a 200 status code and the page title reported by crawlers is “RuTOR – Самый большой форум в СНГ”. Automated analysis identifies the use of UIKit, Yandex.Metrika, Google Tag Manager, Google Analytics, Cloudflare Browser Insights, Cloudflare and HTTP/3.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of credibility. VirusTotal records show that four of ninety‑five scanning engines flag the host, reinforcing the suspicion of malicious activity. The threat classification is “Brand Impersonation” targeting the Telegram brand, consistent with the intelligence that the site attempts to masquerade as a legitimate Telegram resource.

The risk rating is high and the operational status is marked as active. Defenders should add the IP address 172.67.69.69 to deny‑list rules, enforce DNS filtering for rutor24x7.to, and monitor traffic to the associated Cloudflare nameservers hans.ns.cloudflare.com and kami.ns.cloudflare.com. Because the site presents a valid TLS certificate and returns a normal HTTP response, conventional URL‑based blocking may be required to prevent credential‑stealing attempts. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the detection profile.