toehhfw[.]shop

Analysis of the domain toehhfw.shop indicates active phishing infrastructure targeting users of the Messenger platform. Registered through Nicenic International Group Co., Limited, the domain resolves to the IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. Infrastructure analysis reveals nameservers ns3.my-nddns.com and ns4.my-nddns.com, which are consistent with previously observed phishing campaigns. The SSL certificate is issued for Telegram and a wildcard *.local domain, suggesting an attempt to lend legitimacy to the fraudulent site, though the page title explicitly displays 'Messenger,' aligning with the impersonation target. The domain appears on one security blocklist and has been flagged by 20 of 91 security vendors in VirusTotal, with PhishDestroy currently blocking access. AlienVault OTX reports the domain in two threat intelligence pulses, further corroborating its malicious classification. Google Safe Browsing has flagged the site for social engineering, a designation typically applied to pages designed to deceive users into divulging credentials or sensitive information. The HTTP status code 200 confirms the site is operational as of the report date, posing an ongoing risk. Defenders should treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Given the use of known phishing nameservers and a hosting provider associated with malicious activity, organizations are advised to monitor for connections to 27.124.47.186 and related infrastructure. The exact content of the phishing page remains unanalyzed, but the combination of technical indicators and detection counts strongly supports its classification as a credential-harvesting site. No evidence suggests a broader campaign beyond this domain, though further correlation with other domains using the same nameservers or registrar may reveal additional threats.