tosisuuf[.]shop

The domain tosisuuf.shop is currently active and returns HTTP 200. Registry data show it was created through Nicenic International Group Co., Limited, and the authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. DNS resolution points to 27.124.47.186, an IP attributed to Rackip Consultancy Pte. Ltd. in Hong Kong. The TLS certificate presented for the host is issued to Telegram / *.local, an incongruous subject that may indicate certificate misuse. Threat intelligence sources have recorded the domain in three AlienVault OTX pulses and it is listed on a single security blocklist. The PhishDestroy platform has already blocked the domain, and 14 of 91 vendors on VirusTotal have marked it as malicious. The only observed page title is “Messenger”, suggesting a possible impersonation of a messaging service, but the content has not been publicly analysed. Based on this evidence the domain should be added to network deny lists, traffic to its IP should be monitored, and any associated certificates flagged for revocation. Further investigation is advised to determine the payload delivered after the initial page load.