toeogmp[.]shop

The domain toeogmp.shop is currently active and serves a generic phishing campaign targeting messenger credentials. Infrastructure analysis shows the domain resolves to 27.124.47.186, an IP registered to Rackip Consultancy Pte. Ltd. in Hong Kong. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com, and the registration was performed through Nicenic International Group Co., Limited. The site presents an HTTPS certificate issued to Telegram with a wildcard *.local subject, which is inconsistent with the public domain and may be used to lend legitimacy. Google Safe Browsing flags the site for social engineering, and VirusTotal reports 19 of 91 scanned security vendors flagging the domain, indicating a notable malicious disposition. AlienVault OTX lists the domain in three separate threat pulses, and it appears on one public blocklist. HTTP requests return status 200, and the page title is “Messenger”, confirming a credential‑harvesting focus. The domain is already blocked by the PhishDestroy service. Uncertainty remains regarding the exact phishing kit and whether additional payloads are hosted on the same IP. Defenders should block toeogmp.shop at DNS and proxy layers, monitor outbound connections to 27.124.47.186, and enforce multi‑factor authentication for services that could be targeted through messenger login flows. Continuous re‑scanning with VirusTotal and inclusion in internal blocklists are recommended.