terminal[.]tbdfinance[.]co

Analysis of terminal.tbdfinance.co indicates a high-risk phishing domain currently active as of July 12, 2026. The domain resolves to IP 104.21.16.1, part of AS13335 (Cloudflare, Inc.), located in the US. Infrastructure review shows the domain was registered on February 21, 2026, and presents an HTTP 200 status, suggesting operational hosting. The page title 'Pieni hetki...' provides limited context, and no specific brand or scam type is confirmed from available data. One security vendor flags the domain on VirusTotal, while a single blocklist entry (PhishDestroy) further corroborates malicious classification. The Gridinsoft trust score of 0/100 reinforces the domain's suspicious nature. SSL certificate classification as WE1 indicates potential use of a low-reputation or automated certificate. Defenders should treat this domain as actively malicious, blocking resolution at network and endpoint layers. Given Cloudflare's common use as a reverse proxy for malicious sites, direct IP-based blocking may be ineffective, necessitating domain-specific countermeasures. No evidence currently links this domain to a known phishing kit or targeted brand, leaving exact payload or victim profile uncertain pending further analysis.