txtchec[.]lol

Analysis of the domain txtchec.lol indicates an elevated‑risk generic phishing operation that was taken offline prior to the report date of July 24, 2026. The domain was registered on July 19, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 172.67.139.213, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. A TLS certificate labeled WE1 is present, and an HTTP request returns a 200 status code, suggesting the site was serving content before being withdrawn. VirusTotal scans show that three out of ninety‑five security vendors flagged the domain as malicious, providing independent corroboration of its phishing intent.

The domain appears on five public blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, reinforcing its reputation as a threat. Gridinsoft assigns a trust score of zero out of one hundred, reflecting an extreme lack of confidence in the site’s safety. While the available intelligence confirms the hosting infrastructure, registration details, and detection history, no information is currently available regarding the specific page title, targeted brand, or phishing kit employed. Consequently, the exact content and lure used by the site remain uncertain.

Defenders should continue to block txtchec.lol at network perimeter devices, update DNS filtering policies, and ensure that any cached URLs are purged from internal repositories. Monitoring for re‑use of the underlying Cloudflare IP range or similar domain patterns is advisable, as threat actors often recycle infrastructure after takedown. Organizations using threat‑intelligence feeds should incorporate the listed blocklist identifiers and the domain’s registration metadata to improve early detection of related campaigns.