1165tt[.]com

This domain, 1165tt.com, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials, such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is engineered to mimic legitimate authentication portals, often impersonating financial institutions, email providers, or corporate login pages. Analysis indicates the domain employs social engineering tactics, including urgency-driven messaging and cloned interfaces, to exploit human vulnerabilities and bypass technical security controls. The threat extends beyond individual compromise, as stolen credentials may be leveraged for further attacks, including account takeovers, financial fraud, or lateral movement within corporate networks. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on July 15, 2018, through GoDaddy.com, LLC, and resolves to the IP address 103.143.28.212, located in Hong Kong under autonomous system AS135581 (ONL-HK). Security vendor assessments on VirusTotal flag the domain as malicious, with 20 out of 95 engines detecting it as a phishing threat. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued to "Default Company Ltd," further suggests a lack of legitimate organizational affiliation. The combination of these factors—low-reputation hosting, default SSL certificates, and multi-engine detection—correlates with known phishing infrastructure patterns. Users who have interacted with 1165tt.com should take immediate remedial action to mitigate potential compromise. If credentials were entered on this domain, they must be changed immediately across all platforms where the same or similar passwords were reused. Enable multi-factor authentication (MFA) on all critical accounts, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, including login attempts, password changes, or financial transactions. Organizations should review logs for connections to 103.143.28.212 or the domain itself and assess whether internal systems were accessed using credentials harvested from this site. If corporate credentials were exposed, initiate an incident response protocol to contain potential lateral movement or data exfiltration. Awareness training on recognizing phishing tactics, such as scrutinizing domain names and SSL certificate details, is recommended to prevent future incidents.