tsiovgdn[.]shop

This domain, tsiovgdn.shop, is confirmed to host a phishing infrastructure designed to harvest Messenger user credentials. Analysis indicates the site mimics the legitimate Messenger login interface, presenting a fraudulent page titled 'Messenger' to deceive users into entering their account details. The threat actor likely targets individuals through social engineering tactics, such as fake notifications or direct messages, redirecting victims to this domain to capture their credentials for unauthorized access or further malicious activities. Infrastructure analysis reveals the domain resolves to the IP address 27.124.47.186, a hosting provider commonly associated with malicious activity. The site remains active as of this report, with only 2 out of 95 security vendors on VirusTotal flagging it as malicious, suggesting low detection coverage. The SSL certificate is issued under the name 'Telegram,' which may be an attempt to lend legitimacy to the phishing page or exploit trust in the Telegram brand. No additional registrar or creation date details are available in the current dataset, but the domain's low blocklist count indicates it may still be in the early stages of deployment. Users who have visited tsiovgdn.shop or entered credentials on this site should immediately take corrective actions. First, change the passwords for any accounts accessed through the phishing page, prioritizing Messenger and associated email accounts. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized logins or messages sent from the compromised account. If financial or sensitive personal information was entered, consider reporting the incident to relevant authorities and credit monitoring services. Additionally, scan the device used to access the site for malware, as phishing pages may deliver secondary payloads.