tcinafko[.]shop

Analysis of tcinafko.shop shows a newly registered domain (creation date June 15, 2026) actively serving content (HTTP 200) and targeting credential theft. The domain resolves to IP 27.124.47.186, which is geolocated to Hong Kong and owned by Rackip Consultancy Pte. Ltd. Google Safe Browsing has flagged the site for social engineering, and VirusTotal reports 14 of 91 security vendors flagging the domain, indicating malicious intent. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on at least one public blocklist, with PhishDestroy already blocking it. Registration details list Nicenic International Group Co., Limited as the registrar, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The TLS certificate presented is issued to "Telegram" with a wildcard for *.local, a mismatch that further suggests abuse of a legitimate brand’s identity. The page title returned is "Messenger," but the actual page content has not been examined, leaving the specific phishing workflow uncertain. Defenders should immediately add tcinafko.shop to URL filtering and DNS block lists, monitor for any related C2 infrastructure, and consider sinkholing the IP address to disrupt traffic. Continuous observation of the domain’s DNS changes and any additional security vendor detections is advised to capture evolving threat activity.