tandtinternational[.]shop

The domain tandtinternational.shop was registered on March 11, 2026 via NameCheap, Inc. and is currently flagged as a high‑risk generic phishing site. The site returns HTTP 200 responses with the page title “T” and serves content over an Apache HTTP Server. Its SSL certificate is issued by Let’s Encrypt (R13), indicating active TLS termination. Infrastructure analysis shows the domain resolves to IP 45.12.1.115, which belongs to AS6698 owned by Virtual Systems LLC and is geolocated in Ukraine. Name resolution is handled by dns1.registrar-servers.com and dns2.registrar-servers.com. The domain’s MX records point to eforward3.registrar-servers.com (priority 10), suggesting the attacker may be leveraging the registrar’s mail infrastructure for credential harvesting. Reputation services register a Gridinsoft trust score of 0 out of 100, and two of ninety‑five VirusTotal scanners have flagged the domain as malicious. The domain appears on a single security blocklist and is presently blocked by PhishDestroy. These indicators align with the classification of a generic phishing campaign, although no specific payload or lure details have been observed beyond the generic page title. Defenders should immediately add tandtinternational.shop to URL and email filtering rules and enforce blocklisting at perimeter devices. Continuous monitoring of DNS queries for the domain and its associated nameservers is advised to detect any pivot or replication attempts. Given the active TLS certificate, SSL inspection may be required to uncover the underlying phishing content. Incident response teams should also review inbound mail that references the domain’s MX host to identify potential credential‑stealing attempts.