tirox[.]cc

PhishDestroy has begun tracking tirox.cc as an active generic-phishing domain designed to steal online account credentials. Visitors presented with spoofed login forms are prompted for usernames, passwords, or multi-factor codes under false pretenses, allowing attackers to hijack accounts across banking, email, and social platforms. Reports so far confirm the site has not yet been blocked by any of the 95 antivirus scanners on VirusTotal, indicating threat actors may still be actively iterating on the lure.

This domain was flagged by PhishDestroy’s behavioral pipeline after it was registered on 26 February 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED and began resolving to Internet-facing IP 188.114.97.3. Certificate transparency logs show Let’s Encrypt issued a TLS certificate on the same day, suggesting the attackers moved quickly to host a seemingly legitimate but entirely fraudulent site. The 7/95 VirusTotal count illustrates how new domains can bypass signature-based detection until user or community reporting tips the scales.

If you visited tirox.cc and entered any credentials, immediately change those passwords on a known-good device and enable multi-factor authentication where available. Next, revoke any session tokens or API keys tied to the exposed account. Report the incident to your organization’s security team and file a complaint with the platform you believe was mimicked. Consider running a reputable malware scan and monitor financial or cloud storage accounts for unusual activity for at least 30 days. When in doubt, navigate directly to the official site via a bookmark or manually typed URL instead of following any link or QR code.