ttrecker[.]pro

Analysis of ttrecker.pro indicates a confirmed phishing infrastructure currently active despite presenting an HTTP 521 'Web server is down' error. The domain was registered on April 16, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to 104.21.18.205, an IP address geolocated to Canada and operated by Cloudflare, Inc., a common obfuscation tactic used to conceal malicious origin servers. The domain is served by Cloudflare nameservers (elma.ns.cloudflare.com, lennon.ns.cloudflare.com) and presents a Google Trust Services SSL certificate (WE1), further masking backend hosting details. Security vendors have flagged ttrecker.pro, with 4 of 94 engines on VirusTotal detecting malicious indicators. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is referenced in one AlienVault OTX threat intelligence pulse. While the HTTP 521 status suggests the origin server may be intentionally disabled or misconfigured, the domain remains resolvable and retains active DNS records, indicating potential for imminent reactivation. The page title, 'ttrecker.pro | 521: Web server is down,' does not reveal specific brand targeting or scam type, and no confirmed phishing kit or victim interaction has been publicly documented at this time. Defenders should treat this domain as high-risk infrastructure. The combination of recent registration, Cloudflare proxying, and security vendor detections strongly suggests phishing or fraudulent intent. Network-level blocking of 104.21.18.205 and domain-level sinkholing are recommended until the domain is confirmed inactive or remediated. Continuous monitoring for changes in HTTP status or DNS resolution is advised, as the domain may transition from a dormant state to active phishing operations without notice.