tcinzawn[.]shop

Analysis of the domain tcinzawn.shop indicates active phishing infrastructure targeting users of the Messenger platform. The domain resolves to 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD, and returns an HTTP 200 status, confirming operational status as of July 19, 2026. The page title explicitly displays 'Messenger,' suggesting an intent to impersonate the platform's login or messaging interface, though the exact content and functionality remain unconfirmed due to lack of direct inspection. Technical indicators include an SSL certificate issued for 'Telegram / *.local,' which does not align with the expected branding for Messenger, raising concerns about certificate misuse or misconfiguration. The domain is flagged by 21 of 91 security vendors on VirusTotal, appears on one security blocklist, and is blocked by PhishDestroy. Google Safe Browsing classifies the domain as engaging in social engineering, while AlienVault OTX lists it in three threat intelligence pulses, corroborating its malicious reputation. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to 27.124.47.186 and any associated subdomains. Given the domain's active status and alignment with Messenger-themed phishing, organizations should alert users to potential credential harvesting attempts and verify any reported interactions with the site. Further analysis of the phishing kit or backend infrastructure is recommended to identify additional indicators of compromise.