torcat[.]net

Analysis identifies torcat.net as an active generic phishing infrastructure with a high risk rating. The domain was registered on May 19, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and immediately pointed to Cloudflare's network, resolving to IP address 188.114.96.3. The authoritative name servers, hasslo.ns.cloudflare.com and marlowe.ns.cloudflare.com, confirm that the domain relies on Cloudflare's DNS and CDN services for rapid content delivery and potential obfuscation.\n\nThe site presents a valid HTTPS endpoint secured by a Google Trust Services certificate issued under the WE1 trust anchor, indicating that the attacker has obtained a legitimate TLS certificate, which can increase user trust and reduce suspicion. An HTTP request to the root URL returns a 200 OK status, demonstrating that a web server is actively serving content, though the specific payload was not captured in the available intelligence.\n\nThreat intelligence flags the domain on one blocklist and records a single detection by PhishDestroy, while VirusTotal reports that one of ninety‑five scanned security vendors flagged the domain as malicious. This limited but consistent detection footprint suggests that the domain is newly operational and may not yet be widely indexed by automated scanners, increasing the likelihood of successful phishing deliveries before broader mitigation.\n\nDefenders should block traffic to torcat.net at perimeter firewalls and DNS resolvers, monitor outbound connections to the associated Cloudflare IP 188.114.96.3, and enforce strict email authentication to reduce the chance of credential harvesting. Continuous re‑scanning of the domain with multiple analysis engines is advised, as additional malicious indicators may emerge as the campaign matures.