koonfirmasi-pemulihan[.]tdc[.]my[.]id

The domain koonfirmasi-pemulihan.tdc.my.id is currently classified as a generic phishing site with a high risk rating. Intelligence indicates the domain remains active as of the report date, August 05, 2026, and has been added to the blocklists of PhishDestroy and OpenPhish. Network resolution points to the IPv4 address 188.114.97.3; no additional hosting or ASN details are provided. VirusTotal analysis shows that 15 of 91 scanned security vendors have flagged the domain, demonstrating a moderate level of consensus among detection engines.

The domain also appears on two external security blocklists, reinforcing its malicious reputation. Nameserver information is unavailable (NS_NOT_FOUND), and no registrar or creation date data is supplied, limiting the ability to trace ownership or assess domain age. SSL/TLS characteristics, HTTP response codes, and page title content have not been disclosed, leaving the surface‑web fingerprint incomplete. Given the confirmed phishing classification and the presence on multiple blocklists, defenders should prioritize immediate containment: block the domain and its resolved IP address at perimeter firewalls, proxy filters, and endpoint security solutions.

Incorporate the domain into threat‑intel feeds and SIEM correlation rules to detect any attempted connections or credential submissions. Continuous monitoring for changes in DNS resolution, new hosting infrastructure, or additional detections is advised, as attackers may pivot to alternative IPs or modify the site. Where feasible, sinkholing the IP can disrupt traffic and provide visibility into attempted victim interactions. In the absence of further technical artefacts, the recommendation remains to treat the domain as malicious and enforce strict deny policies across the organization.