vip-ttuex[.]com

vip-ttuex.com was observed in the wild as a social media phishing portal. The domain was registered on 2026-02-21 and is hosted on Cloudflare’s network (AS13335) with the IPv6 address 2606:4700:3030::ac43:cb1d located in the United States. The TLS certificate presented is identified as “WE1”, which is typical for Cloudflare‑issued certificates and does not provide additional validation of the site’s legitimacy. VirusTotal analysis recorded detections from 2 of 93 scanned security vendors, indicating that at least a small subset of AV engines flagged the domain as malicious.

The domain appears on a single external blocklist and is specifically listed by the PhishDestroy feed as a social media phishing source. The site’s current HTTP response is offline, and no active content was reachable at the time of analysis. No public page title, safe‑browsing status, or OTX indicator was supplied, leaving those vectors unverified. The limited detection coverage and the presence on a reputable phishing blocklist suggest an elevated risk despite the low vendor count.

Defenders should add the IPv6 address and the domain name to deny‑list rules, enforce DNS sinkholing for the domain, and monitor outbound traffic for connections to Cloudflare edge nodes that resolve to the same address. Continuous re‑scanning on VirusTotal and periodic checks against threat intelligence feeds are recommended to capture any changes in classification or additional detections. Organizations using social‑media credential harvesting protections should treat any login attempts to vip-ttuex.com as malicious and block them at the proxy or firewall level.