tiopy[.]top

The domain tiopy.top was registered through NameMart Pte. Ltd. on 2026-03-04 and resolves to the IP address 47.86.254.21, which is assigned to ASN 45102 (Alibaba (US) Technology Co., Ltd.) and geolocated in Hong Kong. The site does not present an SSL certificate, operating only over HTTP, and the only visible page title is “tiopy.top/h5/#/”. Public threat intelligence shows that 13 of 95 VirusTotal scanners flagged the domain as malicious, and it appears on a single security blocklist. PhishDestroy has also listed the domain as blocked, confirming its use as a phishing vector before it was taken offline.

Authoritative nameservers are jonah.ns.cloudflare.com and ligia.ns.cloudflare.com, both hosted by Cloudflare. Although the site is currently offline, the underlying IP and DNS infrastructure remain active and could be reused in future campaigns. Defenders should continue to block the domain name and its associated IP at perimeter and DNS filtering layers, monitor the Cloudflare nameservers for any re‑registration of the domain, and incorporate the observed page‑title pattern into web‑proxy or URL‑filtering signatures. Incident response teams ought to update internal threat‑intel repositories with the registration date, registrar, detection count, and blocklist references to improve future correlation.

Because the lack of HTTPS reduces trust signals, browsers’ safe‑browsing mechanisms are likely to flag the site, and the multiple VirusTotal detections suggest recognition by a range of security products. Threat actors often reactivate taken‑offline domains, so the indicator should be retained in blocklists for at least 30 days and automated DNS re‑querying should be employed. Continuous monitoring for new subdomains under the same Cloudflare nameservers is recommended to detect potential reuse of the hosting infrastructure.