INFO: Tycoon 2FA Domains Special Report

LAST UPDATED: 2026-03-04

DEFAULT SEVERITY LEVEL: INFO

This Special Report contains information about domain names that are believed to have been used in the operation of the Tycoon 2FA phishing-as-a-service platform, with domain registration start and end dates falling between 2023-03-19 and 2027-04-03. The data is being shared as an output of the combined international Law Enforcement and private sector disruption operation against Tycoon which was announced publicly on 2026-03-04.

Shadowserver Special Reports are unlike all of our other standard free daily network reports. They do not cover a specific daily 24-hour time period.

Instead, we send out Special Reports in situations where we are able to share one-time, high value datasets that we feel should be reported responsibly for maximum public benefit. Sometimes there are incidents when it would be useful to be able to notify potential victims about events or breaches that may have impacted them outside of the previous 24-hour period, when it may take a number of days for incident responders to conduct forensic investigations and analyzed data becomes available for sharing with potential victims. Although the events included in these Special Reports will fall outside of our usual 24-hour daily reporting window, we believe that there would still be significant benefit to our constituents in receiving and, hopefully, acting on the retrospective data.

If you have missed a Special Report because you were NOT yet a subscriber at the time a report was pushed out, simply subscribe for your network now and specifically request all recent Shadowserver Special Reports – and we will regenerate them specifically for your network, at no cost.

Note that the data shared across special reports may differ on a case by case basis, hence the report formats for individual Special Reports may be different.

The data in this nCSIRT-only Tycoon 2FA Domains Special Report was provided to Shadowserver by operational partners to disseminate only to National CERTs/CSIRTs globally, to maximize remediation efforts.

Note that exact timestamps were not available for individual events, so the timestamp field is set to “2026-03-04 00:00:00”.

This special report has severity level INFO set on all events.  Severity levels are described here.

Filename prefix: 2026-03-04-special. Note: these are accessible in the API using 2026-03-04 as the search date.

Fields

  • timestamp
    The timestamp has been set to "2026-03-04 00:00:00" to represent when this one-off data set was shared with Shadowserver
  • ip
    IP address associated with the domain name on 2026-03-04 (if available)
  • port
    TCP or UDP port identified (unused)
  • protocol
    Protocol associated with the malicious activity (unused)
  • asn
    Autonomous System Number of the affected device (if the domain resolved to an IP address on 2026-03-04)
  • geo
    Country of the affected device (if the domain resolved to an IP address on 2026-03-04)
  • region
    Region of the affected device (if the domain resolved to an IP address on 2026-03-04)
  • city
    City of the affected device (if the domain resolved to an IP address on 2026-03-04)
  • hostname
    The domain name used for the Tycoon 2FA infrastructure
  • naics
    North American Industry Classification System Code (if the domain resolved to an IP address on 2026-03-04)
  • sector
    Sector of the IP in question (if the domain resolved to an IP address on 2026-03-04)
  • tag
    Additional tags for more insight
  • infection
    Description of the malware/infection (unused)
  • public_source
    Source of the data
  • status
    Status of the affected domain, for example, "phishing-as-a-service" infrastructure
  • detail
    URL to obtain more detail (not used, to reduce duplication - URLs provided at the top of this page)
  • account
    The Microsoft Windows user name of the infected users on the infected victim system (unused)
  • method
    Request method (unused)
  • severity
    Severity level
  • hostname_source
    Hostname source
  • first_seen_time
    The time the domain associated with Tycoon 2FA infrastructure was first registered
  • last_seen_time
    The time the registration of the domain associated with Tycoon 2FA infrastructure expires (note that there could have been multiple domain registrations, but only the last expiry time is available)
  • potential_exposure_time
    The number of seconds between first and last seen times for this domain
  • confidence
    Confidence rating of the association of the domain with Tycoon 2FA infrastructure provided by the data source
  • is_panel
    Indicator for domains confirmed as hosting Tycoon 2FA panels (other domains may also have been used to host panels)

Sample

timestamp,ip,port,protocol,asn,geo,region,city,hostname,naics,sector,tag,infection,public_source,status,detail,account,method,severity,hostname_source,first_seen_time,last_seen_time,potential_exposure_time,confidence,is_panel
"2026-03-04 00:00:00",,,,,,,,one.example.com,,,tycoon2fa,,microsoft,"phishing-as-a-service platform",,,,info,,"2024-09-30 00:00:00","2025-09-30 00:00:00",31536000,High,Yes
"2026-03-04 00:00:00",,,,,,,,two.example.com,,,tycoon2fa,,microsoft,"phishing-as-a-service platform",,,,info,,"2024-04-06 00:00:00","2025-04-06 00:00:00",31536000,High,
"2026-03-04 00:00:00",,,,,,,,three.example.com,,,tycoon2fa,,microsoft,"phishing-as-a-service platform",,,,info,,"2024-09-30 00:00:00","2025-09-30 00:00:00",31536000,High,

Our 141 Report Types

« Back to Network Reporting