tosiarye[.]shop

Analysis of the domain tosiarye.shop shows it is actively hosting a phishing campaign that leverages a page titled "Messenger". The site resolves to the IPv4 address 27.124.47.186, which is geolocated to Hong Kong and attributed to Rackip Consultancy Pte. LTD. Registration records list Nicenic International Group Co., Limited as the registrar, and the domain uses the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com. The web server returns HTTP 200 and presents an SSL certificate issued to "Telegram / *.local", a mismatch that further signals malicious intent. Threat intelligence sources corroborate the activity: AlienVault OTX has referenced the domain in three separate pulses, Google Safe Browsing flags it for social engineering, and fifteen of ninety‑one VirusTotal scanners have marked the domain as malicious. It appears on one external blocklist and has been blocked by the PhishDestroy service. While the exact phishing payload and targeted user interaction have not been publicly disclosed, the combination of a deceptive page title, mismatched TLS certificate, and multiple security vendor detections indicates a high‑risk profile. Defenders should add tourl and IP blocklists, enforce DNS filtering for tosiarye.shop, monitor outbound connections to 27.124.47.186, and update endpoint protection signatures to include the observed indicators. Continuous monitoring of OTX and related blocklists is advised to capture any evolution of the campaign.