tglrm17[.]com

This domain, tglrm17.com, was registered on October 13, 2025, through NAMECHEAP INC and remains active as of July 27, 2026. Infrastructure analysis reveals it is hosted behind Cloudflare nameservers (clyde.ns.cloudflare.com and violet.ns.cloudflare.com) and resolves to the IP address 188.114.97.3. The domain is currently flagged by two security blocklists, including PhishDestroy and SEAL, and is classified as a high-risk generic phishing threat. One of 91 security vendors on VirusTotal has detected malicious activity associated with this domain, though the specific nature of the phishing content has not been fully analyzed.

Defenders should note that the domain's use of Cloudflare may obscure direct analysis of its hosting infrastructure, a common tactic to evade detection. The registration age (less than a year old) and the lack of widespread brand association in available intelligence suggest it may be part of a broader, non-targeted phishing campaign. While the exact brand or service being impersonated is not confirmed, the domain's structure and detection patterns align with credential-harvesting portals.

Recommended actions include blocking the domain and its resolving IP at the network perimeter, monitoring for internal access attempts, and reviewing logs for connections to 188.114.97.3. If endpoint protection or email filtering tools support it, prioritize this domain for additional scrutiny. Given its active status and detection by multiple security vendors, assume it poses an immediate risk until further analysis confirms otherwise.