tdcyberdetection[.]icu

Analysis of tdcyberdetection.icu shows a high‑risk, active generic phishing infrastructure. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on 1 May 2026. DNS resolution points to 172.67.189.247, a Cloudflare‑hosted address, with authoritative nameservers jacob.ns.cloudflare.com and kelly.ns.cloudflare.com. The site serves a TLS certificate from Let’s Encrypt (E7) and responds with HTTP 403, indicating that direct content access is blocked. Cloudflare and HTTP/3 are detected, suggesting the operator is leveraging a CDN to hide origin infrastructure. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 / 100, the domain appears on one security blocklist, and PhishDestroy has listed it as blocked. VirusTotal records four detections out of ninety‑one scanners, and AlienVault OTX references the domain in eight threat‑intel pulses. The page title returned is “Just a moment…”, but no further content has been disclosed. While the exact phishing landing page or targeted brand is not publicly observed, the convergence of recent creation, low trust score, multiple vendor detections, and inclusion in blocklists confirms malicious intent. Defenders should block tdcyberdetection.icu at the network perimeter, add it to DNS sinkhole or URL filtering lists, monitor for any new IP resolutions, and treat any traffic to the domain as suspicious. Continuous re‑evaluation is advised in case the operator changes hosting or content.