tbiberkahindo[.]cfd

This domain, tbiberkahindo.cfd, was registered on 12 March 2026 through Aceville Pte. Ltd. and is hosted on the IP address 103.219.251.163, which belongs to AS135444 PT Ikubaru Indonesia. The authoritative nameservers are kurt.ns.cloudflare.com and ophelia.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The site presented a TLS certificate issued by Let’s Encrypt (R13), and the observed technology stack included PHP and support for HTTP/3. VirusTotal recorded three detections out of ninety‑four scanned vendors, confirming that a minority of security products have identified malicious behavior.

The domain is listed on a single blocklist and is actively blocked by the PhishDestroy service. The page title returned was “Register”, and no additional content has been captured because the site is currently offline. The combination of a recent registration date, use of a free certificate, Cloudflare DNS, and detection by multiple security vendors aligns with patterns observed in generic phishing operations.

However, the limited number of detections and the presence on only one blocklist leave some uncertainty regarding the full scope of the campaign and the specific targets or payloads delivered. Defenders should block the domain at network perimeter, add the IP 103.219.251.163 to deny lists, and monitor for any related domains that share the same registrar or nameserver configuration. Continuous re‑scanning on VirusTotal or similar platforms is advised to capture any new detections, and threat‑intel feeds should be updated to reflect the observed indicators of compromise.