tacticrider646[.]top

This domain is classified as a high-risk generic phishing operation. Analysis indicates that the infrastructure may be used to lure users into submitting credentials, personal information, or other sensitive data through deceptive web content. No specific impersonated brand has been identified from the available intelligence, and no drainer kit attribution is currently available. The site remains active and should be treated as potentially malicious until proven otherwise.

Technical indicators support the assessment. VirusTotal reports detections from 13 out of 95 security vendors. Registration records show the domain was registered through Dynadot LLC and created on June 12, 2026. DNS resolution maps the domain to IP address 104.21.12.241. The site presents a TLS certificate issued by Google Trust Services / WE1. Intelligence sources indicate presence on 1 security blocklist and confirm blocking by PhishDestroy. Available telemetry identifies the infrastructure as currently active.

Current risk remains elevated because the domain is still online and accessible. Users who interacted with the site should assume any submitted information may have been exposed. Recommended actions include changing potentially affected passwords, reviewing account activity for unauthorized access, enabling stronger authentication controls where available, and monitoring for suspicious follow-on activity. Security teams should consider blocking the domain across network, DNS, proxy, and endpoint controls, preserving relevant logs, and investigating any connections to 104.21.12.241. Continued monitoring is advised due to the active status and the 13/95 detection rate observed across security vendors.