tcisikgt[.]sbs

Analysis of tcisikgt.sbs, reported on July 19, 2026, identifies the domain as an active, high‑risk generic phishing indicator. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the nameservers ns3.my-ndns.com and ns4.my-ndns.com. Infrastructure inspection shows it resolves to IP 27.124.47.186, which is hosted in Hong Kong by Rackip Consultancy Pte. LTD. The site presents an HTTP 200 response and advertises a TLS certificate issued to Telegram with the wildcard *.local, while the page title reports "Messenger". Threat intelligence references include two AlienVault OTX pulses that reference the domain, and it is listed on one external blocklist. Defensive aggregators have already blocked the domain via PhishDestroy, and VirusTotal scans record seven detections out of ninety‑one scanners, indicating partial consensus among security products. While the available data confirms the domain’s malicious intent, details of the phishing payload, target audience, or compromised credentials are not disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any outbound connections to 27.124.47.186, and update endpoint detection rules to flag the associated TLS fingerprint. Ongoing observation is advised to capture any evolution of the campaign.