tutamail[.]zip

This domain is flagged for hosting a credential theft phishing page targeting users of email services. The infrastructure impersonates legitimate webmail portals to trick visitors into submitting account credentials, which are then captured by threat actors for unauthorized access or further exploitation. Analysis indicates the page was designed to appear as a functional email login interface, though it currently returns a 522 timeout error from Cloudflare's network. Infrastructure analysis reveals the domain was registered on April 28, 2026 through Fewmoretaps OU d/b/a Trustname.com, with an SSL certificate issued by Let's Encrypt. Despite its recent creation, the domain has already appeared on one security blocklist, though it remains undetected by antivirus engines, showing 0/95 detections on VirusTotal. The site resolves to IP address 172.67.182.84 and uses Cloudflare's HTTP/3 protocol, which may help evade detection by masking the origin server's true location and characteristics. Users who visited tutamail.zip should immediately revoke any credentials entered on the site, particularly email account logins. Monitor associated accounts for unauthorized activity, including password reset attempts or suspicious login notifications. Organizations should add the domain and IP 172.67.182.84 to network blocklists, and security teams should examine proxy logs for connections to this infrastructure. The domain's use of Cloudflare suggests potential for rapid redeployment, warranting continued monitoring of related indicators.