taoihhbe[.]shop

The domain taoihhbe.shop is currently active and serves HTTP content with a 200 response. DNS resolution points to IP 27.124.47.186, which is allocated to Rackip Consultancy Pte. Ltd in Hong Kong. The site presents an SSL certificate issued to “Telegram / *.local”, a mismatch that is typical of phishing infrastructure. Authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com, and the registrar listed is Nicenic International Group Co., Limited. The page title returned is “Messenger”, but no further content analysis is available. Threat intelligence sources corroborate malicious use: AlienVault OTX includes the domain in two separate pulses, and PhishDestroy has already blocked it. It appears on a public security blocklist, and VirusTotal scans show 14 of 91 scanners flagging the domain. The combined evidence justifies a high risk rating. Uncertainty remains regarding the exact payload or credential‑capture mechanisms, as the page content has not been publicly dissected. Defenders should add the domain and its resolving IP to outbound‑filter rules, monitor DNS queries for the associated name servers, and consider sink‑holing the IP address. Ongoing collection of page content and traffic patterns is recommended to refine detection signatures.