tranquilitymonolith[.]shop

This domain, tranquilitymonolith.shop, is assessed as an elevated-risk generic_phishing infrastructure currently in an offline state. The observed threat pattern indicates potential fake login or credential harvesting behavior, consistent with phishing infrastructure designed to simulate legitimate authentication portals.

Technical telemetry shows the domain was flagged by 5 of 95 VirusTotal security vendors and has a Gridinsoft trust score of 0/100, indicating extremely low reputation. It is associated with IP address 172.67.137.44 and uses Cloudflare infrastructure with HTTP/3 support. The domain was registered on June 12, 2026, and presents SSL issuance from Google Trust Services. Additional intelligence sources include appearance in 4 AlienVault OTX threat intelligence pulses and listing on 2 security blocklists. The page title resolves to "tranquilitymonolith.shop | 523: Origin is unreachable," consistent with inactive or terminated origin hosting behavior.

At present, the domain is taken offline, reducing immediate exploitation risk, but historical indicators suggest prior malicious deployment capability. Recommended mitigation includes continued DNS and URL blocking, monitoring for reactivation on alternate hosting infrastructure, and correlation of IP 172.67.137.44 with related phishing campaigns. Security teams should also review any authentication logs for credential submission attempts tied to this domain and enforce phishing-resistant MFA to mitigate potential credential reuse risks.