txdmv[.]wdtiq[.]cc

The domain txdmv.wdtiq.cc was registered on February 21, 2026. It resolves to the IP address 172.67.131.99, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The SSL certificate presented for the host is identified as WE1, indicating a generic certificate without extended validation. VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain as malicious, suggesting a moderate level of confidence among security products.

The domain appears on a single external blocklist and is actively blocked by the PhishDestroy feed, reinforcing its classification as a phishing infrastructure. As of the report date, the host is reported offline, and no HTTP response was captured, limiting current content analysis. No page title, brand reference, or additional payload details have been disclosed.

The combination of recent registration, association with a known CDN provider, detection by multiple AV engines, and blocklist presence points to a likely phishing campaign targeting users with a short‑lived landing page. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP for any future activation, and consider adding the host to internal threat intelligence repositories. Additional investigation, such as sandbox capture of the landing page when it reappears, would be required to confirm the phishing vector and any credential‑stealing capabilities.