teksanlq[.]com

Analysis of the domain teksanlq.com, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicates active phishing infrastructure targeting users of the Messenger platform. As of July 19, 2026, the domain resolves to the IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. The page title explicitly displays 'Messenger,' suggesting an attempt to impersonate the legitimate messaging service for credential harvesting or social engineering purposes. Infrastructure review reveals the domain is configured with nameservers ns3.my-nds.com and ns4.my-nds.com, a pattern consistent with other phishing campaigns observed in recent months. The SSL certificate, issued for 'Telegram' and a wildcard *.local domain, does not align with the purported Messenger branding, further indicating misrepresentation. Google Safe Browsing has flagged the site for social engineering, and PhishDestroy has added it to its blocklist, corroborating its malicious classification. VirusTotal reports 14 detections from security vendors, though the absence of additional context limits attribution to a specific phishing kit or actor. The HTTP status code 200 confirms the site is operational and serving content, though the exact nature of the phishing mechanism remains unconfirmed without further analysis. Defenders are advised to block the domain and IP at the perimeter, monitor for credential theft attempts originating from this infrastructure, and alert users to the ongoing threat. Given the domain's registration and hosting patterns, similar campaigns may emerge under related nameservers or registrars.