online[.]timetax[.]pl

The domain online.timetax.pl is currently active and serves a page titled “Timetax Online”. DNS resolution points to IP 185.201.112.100, which is geolocated to Poland and announced by AS198414 (Cyber_Folks S.A.). The host is fronted by Cloudflare’s evan.ns.cloudflare.com and zelda.ns.cloudflare.com name servers and presents a valid Let's Encrypt R12 TLS certificate. HTTP requests return status 200, and the site runs a stack that includes Nginx, Vue.js, OneSignal, Hotjar, Google Tag Manager and Cookiebot. Threat intelligence flags the domain as a generic_phishing site with a high risk rating. VirusTotal reports three of ninety‑one security vendors flagging the domain, while Gridinsoft assigns a trust score of 0 / 100 and the domain appears on one external blocklist. PhishDestroy has already blocked the domain, indicating that at least one mitigation service has taken action. The evidence confirms that the infrastructure is deliberately configured to host a phishing campaign, but the exact phishing template or targeted credentials have not been disclosed. Defenders should continue to block the domain at network perimeters, update URL filtering feeds with the IP address and associated AS, monitor for any new sub‑domains resolved by the same Cloudflare name servers, and consider sink‑holing traffic to the IP to collect further indicators of compromise.