potatotf[.]com

Analysis indicates that the domain potatotf.com was registered on 20 Nov 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335). The authoritative name servers are braden.ns.cloudflare.com and mallory.ns.cloudflare.com, which resolve the domain to the IP address 188.114.97.3 located in the United States. No TLS certificate was observed, meaning connections are unencrypted. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. In the Open Threat Exchange, the domain is referenced in three separate threat‑intel pulses, reinforcing its association with malicious activity.

VirusTotal reports that 22 of 95 scanned security vendors flagged the domain as malicious, providing a multi‑engine consensus of risk. Gridinsoft assigned a trust score of 11 / 100, indicating very low confidence in the domain’s legitimacy. The current operational status is offline, suggesting the site has been taken down or is no longer serving content. While the evidence confirms that the infrastructure is tied to a generic phishing campaign, the exact payload, landing‑page content, and targeted brand have not been disclosed in the available data.

Consequently, defenders cannot ascertain the specific credential‑stealing techniques or victim profile beyond the generic classification. Given the observed indicators—recent registration, lack of TLS, association with multiple threat‑intel sources, a majority of vendor detections, low trust score, and blocklist listings—security teams should treat potatotf.com as hostile. Recommended actions include adding the domain to internal blocklists, monitoring DNS queries for the 188.114.97.3 address, and ensuring that web‑filtering solutions deny traffic to the domain. Continuous re‑evaluation is advised in case the site re‑appears or additional context becomes available.