tmstls[.]com

The domain tmstls.com has been identified as a fraudulent impersonation of TMGM, a legitimate forex and commodities trading platform. Analysis indicates this is a generic phishing site designed to harvest credentials from users attempting to access trading services for foreign exchange, gold, and crude oil markets. The domain is currently offline, though prior activity suggests it was actively targeting individuals seeking financial trading portals. Infrastructure analysis reveals the domain was registered through West263 International Limited on December 02, 2025, an unusually recent creation date that aligns with common phishing campaign timelines. It resolved to the IP address 104.143.32.192 and was flagged by 4 of 95 security vendors on VirusTotal, with additional detections on three security blocklists. The domain appears in one AlienVault OTX threat intelligence pulse, and Gridinsoft assigned it a trust score of 0 out of 100. The page title, "TMGM官网 | 专业外汇交易平台 - 外汇、黄金、原油交易入口," directly mimics the branding and language used by the legitimate TMGM platform, reinforcing its deceptive nature. The domain has since been taken offline, though the infrastructure may resurface under a different name or IP. Organizations and individuals are advised to monitor for similar impersonation attempts, particularly those targeting financial services. Network administrators should block the IP 104.143.32.192 and the domain tmstls.com at the perimeter level. Users who may have interacted with the site should immediately reset credentials for any financial or trading accounts, enable multi-factor authentication where available, and review transaction histories for unauthorized activity. Vigilance is recommended for domains registered through West263 International Limited, as this registrar has been associated with other phishing campaigns.