tt-come[.]cfd

This domain, tt-come.cfd, is currently flagged as an active generic phishing threat designed to deceive users into submitting sensitive credentials. Analysis indicates the site employs a static page titled 'Bitte warten...' (German for 'Please wait...'), a common tactic to simulate loading while capturing input data. No specific brand impersonation has been confirmed, but the page structure suggests targeting of login portals or multi-factor authentication flows. Infrastructure analysis reveals the domain was registered on July 06, 2026, through GLOBAL ASSET DOMAINS INC, an entity frequently associated with high-risk registrations. It resolves to the IP address 87.120.107.174, which has been linked to prior malicious activity. The domain's SSL certificate is issued by Let's Encrypt, a legitimate provider often abused by threat actors to lend false credibility. As of the latest scan, 17 of 95 security vendors on VirusTotal have detected this domain as malicious, with detections spanning phishing, fraud, and credential theft categories. No additional blocklist entries or trust scores were identified in public repositories. The domain remains active and poses an elevated risk to users encountering it through phishing emails, malicious redirects, or compromised advertisements. Organizations are advised to implement immediate network-level blocking of tt-come.cfd and its resolving IP 87.120.107.174. Endpoint protection rules should be updated to flag any processes attempting to connect to this domain. Users who may have interacted with the site should reset credentials for any accounts accessed during the suspected exposure window and enable multi-factor authentication where available. Security teams are encouraged to monitor for related indicators, including the domain's creation date (2026-07-06) and registrar details, to identify potential campaign linkages.