t70r[.]top

Analysis of t70r.top indicates this domain is an active phishing site with elevated risk, confirmed by multiple independent detection sources. The domain was registered on May 26, 2026, through NameMart Pte. Ltd., a registrar frequently associated with short-lived malicious domains. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy, a specialized anti-phishing service. VirusTotal scans reveal that 16 out of 91 security vendors flag t70r.top as malicious, a detection rate consistent with confirmed phishing infrastructure rather than false positives or low-confidence alerts.

Infrastructure analysis reveals no additional hosting or network details, such as autonomous system number (ASN) or geolocation, which limits attribution but does not reduce the validity of the detection evidence. The domain's recent creation date and immediate appearance on security blocklists suggest it was deployed with malicious intent rather than repurposed from legitimate use. While the exact brand or service being mimicked is not specified in available data, the detection context and vendor classifications indicate a focus on financial credential theft, a common objective in phishing campaigns. Defenders should treat t70r.top as a confirmed threat.

Network-level blocking is recommended, particularly for organizations in financial services, e-commerce, or any sector handling sensitive user credentials. Security teams should monitor for connections to this domain in proxy logs, endpoint detection data, and email filtering systems, as phishing sites of this nature are often distributed via spam or malvertising. Given the domain's recent registration and active blocklist status, it is likely to remain operational for only a short period before being taken down or abandoned, a pattern typical of phishing infrastructure.