tb1292923k2[.]top

Analysis of tb1292923k2.top indicates that the domain is currently offline but exhibits multiple indicators of malicious activity consistent with a crypto‑related phishing operation. The domain was registered on 2025-12-21 through NameSilo, LLC and is served by the nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. No SSL certificate is present, meaning the site would have been delivered over plain HTTP. The page title returned by the server is "TGR", which does not reveal a legitimate brand or service and provides no further context about the payload.

The hosting IP address 121.127.232.56 resolves to a server located in Hong Kong and is associated with AS152194 (CTG Server Limited). VirusTotal records show that four of ninety‑three security vendors flagged the domain, highlighting that a minority of scanners identified suspicious behavior. Gridinsoft assigns a trust score of zero out of one hundred, indicating an extremely low reputation. The domain is listed on two public blocklists and has been explicitly blocked by PhishDestroy and ScamSniffer, reinforcing the assessment of malicious intent.

The classified scam type is a crypto scam, suggesting the site was likely used to lure victims into disclosing cryptocurrency credentials or transferring funds. While the offline status limits immediate observation of payload delivery, the convergence of low trust scores, vendor detections, blocklist listings, and the absence of HTTPS collectively support a high confidence rating that the domain was employed for phishing. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any residual traffic to the associated IP, and consider adding the IP address to threat intelligence feeds. Threat hunters should also query historical logs for any connections to the domain or its IP before the takedown, and investigate possible credential theft or crypto wallet exposure associated with the timeframe of activity.