tsiozmxr[.]shop

Analysis indicates that tsiozmxr.shop is an active phishing domain, flagged for its association with social engineering tactics, as reported by Google Safe Browsing. The domain has a page title referencing 'Messenger' which may suggest targeting individuals familiar with messaging applications. This domain has been identified in three threat intelligence pulses on AlienVault OTX, corroborating its malicious activity. The IP address 27.124.47.186 is registered under Rackip Consultancy Pte. LTD in Hong Kong. Infrastructure analysis reveals it uses nameservers ns3.my-ndns.com and ns4.my-ndns.com. Furthermore, PhishDestroy has added this domain to their list of blocked sites, highlighting its risk to online users. The SSL certificate associated with this domain is issued to Telegram, which is often utilized in phishing attempts to lend a veneer of legitimacy. VirusTotal indicates that 16 out of 91 security vendors have flagged this domain, reinforcing its malicious reputation. This domain is currently listed on one security blocklist and continues to operate without restrictions, maintaining an HTTP status of 200. Defenders are advised to block this domain at the network level and educate users on identifying potential social engineering scams associated with messaging applications.