troimnjn[.]shop

On July 19, 2026, the domain troimnjn.shop was identified as an active phishing domain targeting users with a page titled 'Messenger'. The domain resolves to the IP address 27.124.47.186, which is located in Hong Kong and is registered to Rackip Consultancy Pte. LTD. Analysis indicates that the domain has been flagged by 16 out of 91 security vendors, suggesting a significant level of suspicion. The site appears on one security blocklist and has been highlighted in three threat intelligence pulses on AlienVault OTX. Additionally, the domain is blocked by PhishDestroy, further confirming its malicious nature. The SSL certificate used by the domain is issued to Telegram and *.local, which is unusual and may indicate an attempt to mimic a legitimate service. The HTTP status of 200 confirms that the site is operational and accessible. Given the high risk level and the domain's active status, defenders are advised to block access to this domain and educate users about the dangers of visiting untrusted sites, particularly those purporting to be related to messaging services. The exact content and structure of the phishing site have not been analyzed, but the available evidence strongly suggests that it poses a significant threat.