tcismwwf[.]sbs

The domain tcismwwf.sbs is currently active and returns HTTP 200 responses. It resolves to the IPv4 address 27.124.47.186, which maps to a hosting provider in Hong Kong identified as Rackip Consultancy Pte. LTD. The domain was registered on June 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is delegated to the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com. The public web page presents the title “Messenger,” but no further content analysis is available. The TLS certificate presented by the host is issued to *.local with the organization name “Telegram,” a mismatch that suggests the certificate was either self‑signed or improperly configured for the phishing infrastructure. Reputation services flag the domain as high risk: it appears on one blocklist, is referenced in a single AlienVault OTX pulse, and has been detected by 14 of 91 VirusTotal scanners. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed as blocked by PhishDestroy. While the exact phishing campaign details (e.g., target brand, credential collection page) have not been disclosed, the combination of a generic “Messenger” page title, a mismatched TLS certificate, and multiple security vendor detections indicates a purpose-built phishing operation. Defenders should block the domain at network perimeter and DNS layers, monitor for outbound connections to 27.124.47.186, and update internal threat feeds with the observed indicators. Ongoing observation of the domain’s activity and any changes to its DNS records or hosting location is advised to capture potential evolution of the campaign.