web[.]thlimited-cab[.]com

The domain web.thlimited-cab.com was registered on March 12 2026 through Tucows Domains Inc. It resolves to the Cloudflare address 172.67.191.253, which is advertised as part of AS13335 in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, yet HTTP requests return a 526 status, indicating a TLS handshake failure on the Cloudflare edge. VirusTotal analysis shows that 16 of 95 scanned security vendors flag the domain as malicious, and the URL appears on three independent blocklists. Google Safe Browsing classifies the site under the SOCIAL_ENGINEERING category, and the Gridinsoft trust score is 0 out of 100. The domain is also listed as blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a generic phishing operation. The landing page delivers the title “TRAGO MILLS” and is built with Vue.js, Highcharts, and Cloudflare’s HTTP/3 stack. The use of a legitimate‑looking brand name combined with interactive chart components suggests an attempt to lure victims into submitting credentials or financial information. The presence of high‑level JavaScript frameworks indicates that the page may dynamically render phishing forms or redirect users to additional malicious payloads. Defenders should immediately add web.thlimited-cab.com and its resolved IP 172.67.191.253 to deny‑list rules across perimeter firewalls, DNS resolvers, and proxy appliances. Monitoring of outbound traffic for connections to Cloudflare edge nodes associated with this address can help identify compromised clients. Security teams are advised to update URL filtering and email security signatures to include the known hostnames and the observed page title, and to educate users about unsolicited requests that reference “TRAGO MILLS” or similar branding.