scottytheai[.]com

scottytheai.com is currently active and classified as a high‑risk generic phishing site. The domain was registered on April 28 2023 through Tucows Domains Inc. and resolves behind Cloudflare’s network, which provides DDoS mitigation and SSL termination. An HTTP 200 response is returned for the landing page, indicating that the site is presently serving content.

Infrastructure analysis reveals that the site enforces HTTP Strict Transport Security (HSTS) and supports HTTP/3, suggesting a modern TLS configuration. Embedded third‑party services include Google Tag Manager, Google Analytics, and the advertising platform Adform, all of which can be leveraged for tracking or payload delivery. The presence of Cloudflare also masks the origin IP, complicating attribution.

Threat intelligence shows the page title “Scotty AI | Top Crypto AI Platform”, a branding pattern commonly abused in crypto‑related phishing campaigns. VirusTotal reports two detections out of ninety‑five scanners, confirming malicious behavior. The domain appears on one security blocklist and is listed by PhishDestroy as a confirmed phishing host, reinforcing the high‑risk assessment.

Defenders should immediately block scottytheai.com at the DNS and proxy layers and add it to endpoint URL filtering policies. Continuous monitoring of DNS queries for the domain and its associated CNAME records is advised, as threat actors may pivot to sibling domains hosted on the same Cloudflare account. Incident response teams should also scan inbound traffic for payloads linked to the identified analytics and advertising services, and consider sinkholing the domain to disrupt ongoing campaigns. User reports indicating credential harvesting attempts should be escalated to the phishing response team for forensic capture of submitted data.