tchmypssy[.]life

PhishDestroy identifies tchmypssy.life as an active credential-harvesting phishing domain currently under investigation by the SOC team. The site is designed to mimic a legitimate login portal and harvest user credentials under false pretenses. At present, no specific brand is known to be impersonated, though the page structure and social-engineering tactics suggest a broad, opportunistic campaign targeting unsuspecting users.

This domain was flagged by 6 of 95 VirusTotal vendors as of the latest scan, indicating it remains undetected by most antivirus engines. The domain resolves to IP address 104.21.2.150 and utilizes a Let’s Encrypt SSL certificate to enhance its perceived legitimacy. Registered through NameSilo, LLC on March 16, 2026, the domain has not yet been listed on major threat intelligence blocklists. Current trust scores from threat intelligence platforms remain neutral, reflecting its early-stage operational status and low detection footprint.

Given the active status and low detection rate, tchmypssy.life poses a moderate but evolving risk to users who may encounter it via phishing emails, malicious links, or compromised advertisements. The SOC recommends immediate network-level blocking of the domain and associated IP (104.21.2.150) via DNS sinkholing or firewall rules. Users should be warned against entering credentials on any unfamiliar login pages and encouraged to verify URLs and SSL certificates prior to submission. Continuous monitoring of the domain for new detections and blocklist additions is advised. Investigative efforts are ongoing to trace the infrastructure and potential affiliations with known threat actors.