torahacademymil[.]org

torahacademymil.org was registered on 15 April 2026 through GoDaddy.com, LLC. The registration is recent and coincides with the appearance of the domain on multiple security feeds. The domain resolves to the IP address 45.60.22.179, which is associated with a US‑based infrastructure operated by a large content‑delivery and security provider. The authoritative name servers are ns2169.hostgator.com and ns2170.hostgator.com, indicating the use of a commercial hosting platform. The observed HTTP response for the root URL returns status code 406, suggesting that the server is configured to reject requests that do not meet specific content‑type criteria. The TLS handshake presents a GlobalSign Atlas R3 DV certificate issued in the fourth quarter of 2025, confirming that the domain is using a valid, publicly trusted certificate. The combination of a legitimate certificate and a reputable hosting environment is consistent with tactics used to increase user trust in phishing campaigns. Threat intelligence sources have flagged torahacademymil.org as a phishing vector. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering system. AlienVault OTX records the domain in one pulse, and VirusTotal reports a single positive detection out of ninety‑five scanned security vendors. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the assessment of malicious intent despite the low detection count. While the current evidence confirms the domain’s involvement in generic phishing, the lack of a full page capture limits insight into the specific lures or credential‑harvesting forms employed. Defenders should prioritize immediate blocking of the domain at perimeter and DNS layers, monitor for any new subdomains or IP changes, and consider sinkholing the associated IP range to disrupt ongoing activity. Ongoing telemetry collection is advised to capture any evolution of the payload or targeting patterns.