tcisjqmi[.]sbs

The domain tcisjqmi.sbs is currently active and resolves to the IP address 27.124.47.186, which is hosted in Hong Kong by Rackip Consultancy Pte. Ltd. Registration was handled by NICENIC INTERNATIONAL GROUP CO., LIMITED and the authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. An HTTP request returns a 200 status code and the page title is “Messenger”. The TLS certificate presented is issued to Telegram and covers the wildcard *.local, a mismatch that is often observed in malicious infrastructure. The domain appears in two AlienVault OTX threat pulses and has been flagged by 17 of 91 security vendors on VirusTotal. It is listed on one public blocklist and is actively blocked by the PhishDestroy feed. While the exact phishing lure has not been publicly disclosed, the combination of a generic “Messenger” title, mismatched certificate, and multiple vendor detections indicates a high‑risk phishing operation. Defenders should add tcisjqmi.sbs to URL filtering and DNS blocklists, monitor outbound connections to the associated IP, and consider sinkholing the domain to disrupt further activity. Continuous threat‑intel monitoring is advised to capture any emerging payloads or victim‑targeting patterns.