tikdon[.]com

tikdon.com is currently active and serves a page titled “TikDon.Com – Activer la monétisation”. The site resolves to the IP address 185.66.140.182, which belongs to AS200514 KnownSRV Ltd. registered in the Netherlands. The domain was created on February 21 2026 and was registered through NameCheap, Inc.; its authoritative name servers are ns13.knownsrv.com and ns14.knownsrv.com. An HTTPS endpoint is presented using a Let’s Encrypt R12 certificate, and the web server returns HTTP status 200. Detected server technologies include LiteSpeed, Alpine.js, jsDelivr, and support for HTTP/3.

Reputation metrics are extremely low, with a Gridinsoft trust score of 1 / 100, and the domain appears on one public security blocklist. It is also listed as blocked by PhishDestroy. Threat‑intelligence feeds corroborate the malicious classification: AlienVault OTX includes tikdon.com in a single pulse, and VirusTotal records 13 of 93 scanning engines flagging the domain as malicious. These observations collectively justify a high‑risk rating. Gaps remain, however: the blocklist coverage is limited to a single entry, no additional OTX pulses are observed, and no public samples of the phishing content have been shared, leaving the full operational scope of the campaign uncertain.

Defensive recommendations are to deny any network traffic to 185.66.140.182, add tikdon.com to DNS sinkhole or proxy deny lists, and enable URL filtering rules that block the domain at the perimeter. Continuous monitoring of NameCheap registration trends for similarly‑named domains and periodic rescanning on VirusTotal are advisable, as detection counts may rise. Logging of TLS handshake attempts to the Let’s Encrypt certificate can provide early detection of attempted connections. User awareness training should highlight the French‑language page title as a potential lure for French‑speaking users, and organizations should enforce multi‑factor authentication to reduce the impact of possible credential theft.