55115n[.]com

55115n.com was registered through GoDaddy.com, LLC on 2 December 2024. The domain uses Cloudflare DNS (austin.ns.cloudflare.com, leia.ns.cloudflare.com) and resolves to 104.21.73.176, an address owned by AS13335 Cloudflare, Inc. in the United States. No TLS certificate is present, and the site is currently taken offline, returning no HTTP response. Reputation services assign extremely low trust scores: Gridinsoft 0/100 and Scamadviser 1/100.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. AlienVault OTX lists the domain in 17 separate threat‑intel pulses, indicating repeated use in malicious campaigns. VirusTotal analysis shows that 17 of 95 scanning engines flagged the domain, reinforcing the suspicion of abuse. The combination of a recent registration, Cloudflare front‑end, lack of encryption, and multiple detections suggests the domain was employed for credential‑stealing or other phishing operations.

Because the site is offline, active probing is limited, but defenders should continue to monitor DNS queries for 104.21.73.176 and enforce blocking of the domain at perimeter firewalls, proxy filters, and endpoint security solutions. Additional mitigation includes adding the domain to internal blocklists, updating URL filtering policies, and ensuring that any email or web traffic that references the domain is quarantined. Analysts should also review any logs for connections to the Cloudflare IP range around the registration date, as early traffic may reveal compromised accounts or credential submissions. Until further forensic evidence is obtained, the domain should be treated as a high‑confidence phishing indicator.