troeslgm[.]shop

Analysis of www.troeslgm.shop indicates an active generic phishing infrastructure that remains reachable as of July 22, 2026. The site resolves to the IPv4 address 27.124.47.186, which is registered to Rackip Consultancy Pte. LTD in Hong Kong. DNS resolution is served by ns3.my-ndns.com and ns4.my-ndns.com, and the domain registration was processed through Nicenic International Group Co., Limited. The web server presents an SSL certificate issued to "Telegram / *.local," a mismatch that suggests the certificate was either reused from unrelated services or deliberately misconfigured to evade scrutiny.

The HTTP response code is 200, and the page title returned is "Messenger," though no further content analysis is available. Google Safe Browsing classifies the domain as a social engineering threat, and eight of ninety‑one VirusTotal scanners have raised detections, reinforcing the malicious assessment. The domain appears on a single external blocklist and is listed as blocked by PhishDestroy, confirming that at least one security feed is actively monitoring it.

Risk is rated high, and the infrastructure is currently marked as active. Defenders should consider immediate DNS or firewall blocking of both the domain and its resolving IP, employ sinkholing where feasible, and monitor for any related subdomains that may be provisioned under the same nameservers. Ongoing observation of the certificate usage and any changes in detection counts from VirusTotal or other aggregators is advised to track potential evolution of the campaign.