trcyco3315[.]top

This domain, trcyco3315.top, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis confirms its current status as offline, though it previously posed an elevated risk of credential theft and unauthorized account access. No specific brand impersonation was confirmed, but the generic phishing infrastructure suggests broad targeting of user credentials across multiple platforms. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and resolves to the IP address 172.247.99.170. It is flagged by 7 of 95 security vendors on VirusTotal and appears on one security blocklist. The domain received a trust score of 0/100, indicating no legitimate reputation. Detected technologies include Cloudflare for content delivery, jQuery for dynamic scripting, and cdnjs for library hosting, which are commonly abused to obfuscate malicious activity and evade detection. The domain is currently offline, reducing immediate risk, but historical activity warrants caution. Organizations and users are advised to block the domain and its associated IP (172.247.99.170) at the network level. Security teams should review logs for connections to trcyco3315.top or its IP, particularly from February 2026 onward, to identify potential credential exposure. Implement multi-factor authentication (MFA) for all accounts and conduct user awareness training on recognizing phishing attempts, especially those using generic login prompts or unexpected language (e.g., the observed page title '欢迎').