tbshares[.]net

Analysis of the domain tbshares.net indicates a high‑risk, generic phishing infrastructure that remains active as of 27 July 2026. The domain was created on 25 February 2026 and registered through Web4Africa Inc. Its authoritative name servers are listed as dan1.host-ww.net, dan2.host-ww.net, dan3.host-ww.net, and dan4.host-ww.net, and DNS resolution points to the single IPv4 address 102.130.123.9. VirusTotal scans show that two of ninety‑one security vendors have flagged the domain as malicious, suggesting that detection signatures exist but are not yet widespread.

The domain appears on at least one public blocklist and is explicitly blocked by the PhishDestroy filtering service, reinforcing the assessment that it is being used for credential‑harvesting or related phishing activity. No public page title, SSL certificate details, HTTP status codes, or brand‑targeting information have been disclosed, leaving the exact phishing lure and victim profile uncertain.

Defenders should treat tbshares.net as hostile: block DNS resolution and HTTP(S) traffic to the domain and its resolving IP, add the domain to internal and perimeter blocklists, and monitor network logs for any outbound connections to 102.130.123.9. Sharing the observed indicators—including registration dates, name server set, and IP address—with broader threat‑intel communities will aid collective detection and mitigation efforts.