tt[.]itogitt[.]shop

Analysis of tt.itogitt.shop indicates a confirmed phishing domain with elevated risk, currently offline as of July 24, 2026. The domain was registered on December 30, 2025, through Dynadot LLC and resolves to IP address 104.21.25.240, hosted on Cloudflare's network (AS13335). No SSL certificate is present, a common trait in low-effort phishing infrastructure. The page title matches the domain name, providing no additional context about the target or scam type, and no brand or kit details have been identified in available intelligence.

Security vendor detections are limited but notable: 15 of 93 engines on VirusTotal flagged the domain as malicious. It appears on one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The domain's brief existence (less than seven months at the time of assessment) and use of Cloudflare's CDN are consistent with ephemeral phishing campaigns designed to evade detection and takedown.

Defenders should treat this domain as compromised infrastructure. While the exact phishing lure remains unconfirmed, the combination of no SSL, recent registration, and vendor detections warrants proactive blocking at the DNS or proxy level. Network logs should be reviewed for connections to 104.21.25.240 or tt.itogitt.shop, particularly from endpoints that may have bypassed existing security controls. Given the domain's current offline status, continued monitoring is advised in case it reactivates or re-emerges under a different hostname.