tbcuk[.]top

On 23 July 2026, the domain tbcuk.top was identified as a high‑risk generic phishing site. The domain was registered on 21 February 2026 through NameSilo, LLC and is currently hosted on the IP address 149.104.148.208, which belongs to AS140224 operated by Nebula Global LLC and is geolocated in Hong Kong. DNS resolution is provided by the authoritative name servers ns1.dnsowl.com., ns2.dnsowl.com., and ns3.dnsowl.com., indicating use of the DNS Owl service. The web server presents a valid TLS certificate issued by Let’s Encrypt (certificate label “YE2”), and an HTTP GET request returns a 200 OK status, confirming that the site is reachable and serving content.

The page title observed during analysis is “CSKY”, but no further content details have been disclosed, leaving the specific impersonated brand or service ambiguous. VirusTotal scans have recorded detections by 2 of 93 security vendors, and the domain is listed on two public blocklists, PhishDestroy and ScamSniffer, reinforcing its malicious classification. The infrastructure footprint is limited to a single IP address and a modest DNS footprint, which simplifies attribution and mitigation.

Defenders are advised to add tbcuk.top and its resolving IP 149.104.148.208 to network‑level blocklists, enforce TLS inspection to capture encrypted traffic, and monitor for any related indicators of compromise in endpoint logs. Continuous re‑evaluation is recommended, as the active status suggests the campaign may evolve or expand its infrastructure. The combination of recent registration, active hosting, limited detection coverage, and presence on reputable blocklists underscores the need for immediate protective actions.