tea-enrolls[.]com

This domain, tea-enrolls.com, is identified as an active phishing site designed to harvest cryptocurrency credentials. Analysis indicates the site mimics enrollment or authentication portals commonly associated with blockchain services, though no direct brand impersonation is evident. The infrastructure lacks overt ties to known drainer kits, but the page title 'Tea — Enroll' suggests an attempt to deceive users into submitting sensitive wallet or login details under false pretenses. Technical indicators reveal the domain was registered on June 01, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious registrations. It resolves to IP address 172.67.188.36, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obscure origin infrastructure. As of the latest scan (seed c76789), the domain is flagged by 2 out of 95 security vendors on VirusTotal and appears on three independent blocklists. The SSL certificate is issued by Google Trust Services (WE1), providing a superficial layer of legitimacy while failing to mitigate the underlying threat. The domain remains active and unmitigated, with no evidence of takedown or suspension at the registrar or hosting level. Detection coverage remains low (2/95), indicating potential gaps in automated threat intelligence. Users are advised to treat this domain as hostile and avoid interaction. Organizations should update blocklists to include tea-enrolls.com and monitor for related infrastructure, particularly domains registered through the same registrar or resolving to adjacent Cloudflare IP ranges.