tsiobrlw[.]shop

This domain, tsiobrlw.shop, is actively flagged as a high-risk phishing site impersonating Messenger, as indicated by its page title and infrastructure analysis. Registered under an IP address (27.124.47.186) hosted in Hong Kong by Rackip Consultancy Pte. LTD, the domain resolves successfully with an HTTP 200 status, confirming its operational status as of July 19, 2026. The SSL certificate is issued for Telegram or a wildcard local domain, suggesting misconfiguration or deliberate obfuscation of the true service being mimicked. Analysis reveals the domain has been included in three threat intelligence pulses on AlienVault OTX and appears on at least one security blocklist, with PhishDestroy explicitly blocking it. Fifteen of ninety-one security vendors on VirusTotal have flagged the domain, though the specific detection rules or payloads are not detailed in available intelligence. The combination of a recognized brand impersonation (Messenger), geolocation in a high-risk hosting jurisdiction, and active blocklist presence elevates its threat classification. Defenders should treat this domain as a confirmed phishing resource targeting Messenger credentials or related account compromise. Immediate mitigation steps include blocking the domain and its resolving IP at perimeter security controls, monitoring for internal access attempts, and alerting users to avoid interaction. Further investigation into associated infrastructure (e.g., nameservers, redirects, or linked domains) may uncover broader campaign linkages, though no additional artifacts are currently confirmed.