trtkan[.]org

Analysis of trtkan.org, reported on July 25, 2026, indicates that the domain is currently offline but exhibits multiple indicators of malicious infrastructure. The domain was registered on February 21, 2026 through Dynadot LLC and resolves to the IP address 172.247.73.242, which is listed as belonging to CNSERVERS LLC in the United States under ASN 40065. The hosting server presents an HTTPS certificate issued by Let’s Encrypt (R13), and HSTS headers are observed, suggesting deliberate use of transport security.

The site’s page title is reported as “Welcome”, and automated fingerprinting identified the presence of Bootstrap, Caddy, Swiper, Lodash, jQuery, and HSTS technologies, a stack commonly seen in phishing landing pages. Gridinsoft assigns a trust score of 0 out of 100, and the domain is blocked by PhishDestroy and appears on one external security blocklist. VirusTotal records show that 1 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent.

Nameservers 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com are associated with the domain’s DNS configuration. While the site is no longer reachable, the combination of recent registration, low trust scoring, vendor detection, and blocklist inclusion warrants classification as a phishing threat. Defenders should continue to block the domain, monitor the associated IP and name server infrastructure for potential reuse, and incorporate the indicator set into threat‑intel feeds.