taoiwwuv[.]shop

This domain is flagged as a credential theft phishing site, specifically impersonating the Messenger brand to harvest user login credentials. The threat type is credential theft, targeting users through a fake Messenger login interface. No known drainer kit has been identified, but the page title Messenger indicates a direct attempt to deceive visitors into entering sensitive information.

Infrastructure analysis reveals the following exact indicators: VirusTotal score is 0/95 detections, meaning the domain has not yet been flagged by security vendors. The domain resolves to IP address 27.124.47.186. The SSL certificate is issued by Telegram, which is anomalous for a Messenger-branded site, suggesting use of a potentially misconfigured or fraudulent certificate. The domain is currently active and under investigation. No blocklist count or creation date is provided in the available intelligence, and Google Safe Browsing status is not specified.

The current status is active, with the phishing page still live. The recommended response actions include blocking the domain at the network level, reporting it to hosting providers and domain registrars, and adding it to threat intelligence feeds. The remaining risk is moderate, as the domain has zero detections on VirusTotal and may evade automated security tools. Users should avoid visiting this domain and never enter credentials. Organizations should monitor for any access attempts and update email security filters to block related domains.