enroll-ts[.]info

Analysis of enroll-ts.info, reported on August 04, 2026, categorizes the site as a generic phishing infrastructure with an elevated risk rating. The domain has been observed by multiple defensive platforms. VirusTotal records indicate that six of ninety‑one AV and URL scanning engines have raised a detection flag, suggesting that at least a minority of scanners recognize malicious behavior. Independent blocklist providers PhishDestroy, MetaMask, and SEAL have each added the domain to their deny lists, and the domain appears on three additional public blocklists, reinforcing the consensus that the address is being used for malicious purposes.

The current operational status is listed as active, meaning the site is still reachable on the public internet. No concrete information about the domain’s registrar, autonomous system number, hosting IP address, or SSL configuration has been published in the available intelligence, so those attributes remain unverified. Likewise, the page title and any embedded brand references have not been captured, preventing a more detailed description of the phishing lure. The absence of such data does not imply legitimacy; rather, it reflects a gap in the publicly shared observations.

Defenders are advised to enforce block rules for enroll-ts.info across network perimeter devices, DNS resolvers, and endpoint protection suites. Security teams should monitor the domain for any changes in detection counts or additional blocklist inclusions, and consider adding it to internal deny lists if not already present. Given the elevated risk level, any traffic to or from the domain should be treated as suspicious and subjected to heightened scrutiny, including logging of connection attempts and potential quarantine of associated files or payloads. Continuous threat‑intel feeds should be consulted for updates on registration details, hosting infrastructure, or newly discovered malicious activity linked to this domain.