cab[.]tpcinvstltd[.]com

The domain cab.tpcinvstltd.com is presently active and has been identified as a high‑risk phishing vector. Registration data shows the domain was created on May 20, 2025 through the registrar TUCOWS.COM in the United States, and the current nameservers are abdullah.ns.cloudflare.com and lindsey.ns.cloudflare.com, indicating Cloudflare DNS resolution. Network analysis confirms that the domain resolves to the IP address 104.21.15.229, an address associated with Cloudflare’s edge network, which is commonly leveraged to mask malicious hosting origins.

VirusTotal has recorded detections from three of ninety‑one scanned security vendors, providing concrete evidence that at least a subset of scanning engines have classified the host as malicious. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy mitigation service, reinforcing the consensus that it is being used for phishing. No further content information, such as page title or SSL certificate details, is available at this time, leaving the exact content and impersonated brand unspecified.

The lack of publicly disclosed page metadata creates uncertainty regarding the specific lure employed, but the combination of recent registration, cloud‑based hosting, multiple vendor detections, and blocklist presence signals a purposeful campaign. Defenders should prioritize the addition of cab.tpcinvstltd.com to inbound and outbound filtering rules, ensure that DNS resolvers enforce blocklist entries, and monitor for any traffic to the associated IP address 104.21.15.229. Continuous re‑scanning of the domain with updated threat intelligence feeds is advised to capture any evolution in payload or hosting changes.