sccottytheai[.]today

Analysis of sccottytheai.today indicates that the domain was registered on February 21, 2026 and is currently taken offline. The only visible artifact is the page title “PIGLET13”, which provides no indication of the intended victim or lure. The domain resolves to the IP address 172.67.169.138, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated to the United States. The TLS certificate is issued by GTS CA 1P5, a legitimate Cloudflare‑issued certificate, showing that the operator has obtained a valid SSL certificate but does not imply trustworthiness.

The domain is listed on three independent phishing blocklists—PhishDestroy, ScamSniffer, and Enkrypt—demonstrating that multiple security vendors have observed malicious activity associated with it. VirusTotal records indicate that the domain was scanned by 93 vendors, none of which flagged it at the time of scanning; this lack of detection should not be interpreted as evidence of safety. The combination of a recent registration date, inclusion on multiple blocklists, and the generic “PIGLET13” title aligns with the classification of a generic phishing campaign, though the exact bait or target is not disclosed in the available data. Uncertainty remains regarding the content that was hosted before the takedown, the specific credential‑ harvesting technique employed, and whether any compromised accounts have been used to amplify the campaign.

Defenders should continue to block the domain at perimeter defenses, monitor DNS logs for any attempts to resolve the hostname, and consider adding the associated IP address to network‑level deny lists. Because the site is hosted on Cloudflare’s shared infrastructure, additional scrutiny of other domains sharing the same IP may be warranted. Incident response teams should treat any alerts that reference sccottytheai.today as high‑confidence phishing indicators and correlate them with user‑reported phishing attempts.