tmb-investments[.]com

The domain tmb-investments.com was registered on 11 April 2026 through GoDaddy.com, LLC and is currently classified as a high‑risk generic phishing site. The site hosts a fraudulent investment portal designed to lure victims into providing personal and financial information. Initial detection was logged by PhishDestroy, which has placed the domain on its blocklist, yet the domain remains active as of 12 July 2026.

Technical reconnaissance shows the domain resolves to the IP address 162.159.140.166, a Cloudflare, Inc. server located in Canada. The authoritative name servers are ns49.domaincontrol.com and ns50.domaincontrol.com, both belonging to GoDaddy’s DNS infrastructure. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 identifier, and HTTP responses return a 200 status code, indicating a fully operational web service.

The trust metrics corroborate the malicious intent: Gridinsoft assigns a score of 0 out of 100, and the domain appears in a single external blocklist. VirusTotal records a single positive detection out of 95 scanned security vendors, while AlienVault OTX references one pulse linking the domain to malicious activity. No additional intelligence such as associated command‑and‑control servers or malware hashes is available, leaving the broader campaign infrastructure uncertain.

Defenders should prioritize immediate containment by adding tmb-investments.com to network and endpoint blocklists. Monitoring of DNS queries to the domain’s nameservers and the associated Cloudflare IP is recommended to detect any lateral use. Organizations should also update email security policies to flag messages that reference the domain or employ similar investment‑related lures, and consider sharing the indicator with peer threat‑intel platforms.