global[.]tksellproind[.]cc

The domain global.tksellproind.cc was first observed on July 8, 2025 when it was registered through Gname.com Pte. Ltd. The domain is hosted on Cloudflare infrastructure, using the authoritative name servers amy.ns.cloudflare.com and ben.ns.cloudflare.com, and currently resolves to the IPv4 address 172.67.150.15. VirusTotal has recorded detections from seven of ninety‑one scanned security vendors, indicating that a subset of commercial scanners have identified malicious behavior associated with the domain. The domain is listed on two public phishing blocklists, PhishDestroy and OpenPhish, and both services continue to flag it as active. The threat is classified as generic phishing and assigned a high risk rating by internal scoring.

No additional metadata such as page title, SSL certificate details, or HTTP response codes are publicly available at this time, leaving the exact content and credential‑capture mechanisms unverified. Analysis indicates that the combination of a relatively recent registration, Cloudflare DNS, and a modest but non‑zero detection rate aligns with typical phishing‑infrastructure patterns. The presence on multiple blocklists suggests that the domain is actively used in credential‑harvesting campaigns.

Defenders should add the domain to local deny‑list rules, enforce DNS‑level blocking, and monitor outbound connections to the IP 172.67.150.15 for suspicious traffic. Continuous re‑scanning on VirusTotal or similar aggregators is recommended to capture any changes in vendor detections. Organizations should also educate users about unsolicited login requests that reference unknown URLs, especially those that share the "tksellproind" suffix, and encourage reporting of any suspected attempts to the security team.