tismwlle[.]com

This domain, tismwlle.com, is actively flagged as a high-risk phishing site targeting users through a Messenger-themed interface. Infrastructure analysis reveals the domain resolves to IP 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD. Nameservers ns3.my-nds.com and ns4.my-nds.com are associated with the domain, and it is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The HTTP status returns 200, indicating an operational web page, while the SSL certificate is issued for Telegram or a wildcard *.local domain, which may suggest an attempt to mimic legitimate messaging services. The page title explicitly reads 'Messenger,' aligning with the phishing classification. As of July 20, 2026, the domain appears on one security blocklist (PhishDestroy) and is flagged by 5 of 91 security vendors on VirusTotal. While these detections provide concrete evidence of malicious intent, the exact phishing mechanics—such as credential harvesting, malware distribution, or social engineering tactics—remain unconfirmed due to limited analysis of the site's content. Defenders should treat this domain as an active threat, blocking access at the network level and monitoring for related indicators of compromise. The Hong Kong-based hosting and Telegram-associated SSL certificate may serve as additional pivot points for further investigation. No brand-specific targeting beyond the 'Messenger' title is confirmed, and the phishing kit or payload remains unidentified.