tdccpmeme[.]pw

Analysis of tdccpmeme.pw shows a recent registration (February 21, 2026) through Go Daddy, LLC and immediate deployment of a site hosted behind Cloudflare (AS13335) at IP address 104.21.8.235. The domain resolves to this Cloudflare‑backed IP, utilizes Cloudflare name servers (alla.ns.cloudflare.com, emerson.ns.cloudflare.com), and presents an SSL certificate issued by Google Trust Services / WE1, indicating a valid TLS configuration. HTTP responses return status code 200 and the page title is captured as "$TDCCP", confirming that the site was reachable before being taken offline. Technical fingerprinting reveals the presence of Vercel, HSTS, Google Analytics, and HTTP/3, all typical of modern web services but also common in malicious infrastructure leveraging reputable platforms to evade detection.

The domain is listed on a single security blocklist and has been specifically flagged by PhishDestroy, reinforcing its classification as a generic phishing vector. VirusTotal scans report that one of ninety‑five security vendors identified the domain as malicious, providing a modest but notable detection signal. Independent reputation scoring from Gridinsoft assigns a trust score of 39 out of 100, reflecting low confidence in the domain's legitimacy.

Although the site is currently offline, the elevated risk rating remains justified given the combination of recent creation, rapid deployment, legitimate‑looking TLS, and confirmed detection across multiple threat intelligence sources. Defenders should continue to block tdccpmeme.pw at perimeter controls, monitor DNS queries for the associated Cloudflare IP, and update any web filtering or email security policies to include this indicator. Ongoing vigilance is advised in case the domain is reactivated or similar patterns emerge in other newly registered .pw zones.