tiaaa-cref[.]net

Analysis of tiaaa-cref.net, created on 22 February 2026 and currently offline, indicates a short‑lived phishing infrastructure targeting users with a page titled “Vitalia — Return to Yourself”. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States, and uses Cloudflare’s aida.ns.cloudflare.com and brady.ns.cloudflare.com nameservers. No TLS certificate is present, meaning any HTTP traffic would have been unencrypted. The registrar listed is NiceNIC International Group Co., Limited.

The site was flagged by PhishDestroy and appears on a single external blocklist. VirusTotal scans show two of ninety‑five security vendors flagged the domain, providing limited but corroborating evidence of malicious intent. Because the site is no longer reachable, dynamic content cannot be examined, and the exact phishing payload or credential‑harvesting mechanism remains unknown. Defenders should continue to block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions.

Monitoring for new domains that resolve to the same Cloudflare IP range or that use the same registrar and nameserver pair is advisable, as attackers often reuse this infrastructure. Given the absence of SSL, any future activation would expose clear‑text traffic, offering an additional detection vector for network‑based sensors. Organizations should also review logs for any historic connections to 188.114.97.3 and consider user awareness messaging that references the “Vitalia — Return to Yourself” title to help identify residual phishing attempts.