tacgbr[.]pro

Analysis of the domain tacgbr.pro indicates that it is currently offline but was previously associated with a crypto‑drain phishing campaign. The site resolved to the IPv4 address 121.127.232.56, which is registered to CTG Server Limited in Hong Kong under ASN 152194. The hosting provider is MEGA‑II, as reflected in the registrar information. No TLS certificate was observed for the host, meaning all traffic would have been unencrypted if the site were active. The page title returned by the server was "TGR," providing no additional context about the intended victim audience.

Gridinsoft assigned a trust score of 0 out of 100, indicating a highly suspect reputation. VirusTotal submissions show that 11 of 95 scanners flagged the domain, confirming the presence of malicious payloads or phishing indicators. Independent blocklist services PhishDestroy and ScamSniffer have already added tacgbr.pro to their deny lists, and the domain appears on two additional public blocklists. The observed scam classification is a crypto scam, which aligns with the low trust score and multiple vendor detections. Nameserver configuration consists of ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, a common setup for short‑lived malicious domains.

Uncertainty remains regarding the specific phishing kit or payload delivered, as no further artifacts such as HTML content or redirect behavior have been captured. Defenders should continue to block the domain at perimeter firewalls and proxy devices, enforce TLS inspection policies to detect any future unencrypted traffic, and monitor the associated IP address for ancillary activity. Threat‑intel teams should add tacgbr.pro to internal watchlists and consider sharing the indicator of compromise with partner ISPs to expedite upstream filtering. Ongoing vigilance is recommended because the infrastructure—particularly the Hong Kong‑based IP range—may be reused for additional cryptocurrency‑focused campaigns.