tecienvw[.]shop

On 19 July 2026 the domain tecienvw.shop was observed hosting a page titled “Messenger”. The site presents a TLS certificate issued to “Telegram / *.local”, which does not match the public‑facing domain and suggests a mis‑configured or deliberately misleading certificate. Registration records list Nicenic International Group Co., Limited as the registrar. DNS resolution points to 27.124.47.186, an address attributed to Rackip Consultancy Pte. Ltd in Hong Kong. The HTTP response returned status 200, indicating the server is actively serving content. The domain appears on a single security blocklist and is listed by PhishDestroy as a confirmed phishing site. VirusTotal scans show six of ninety‑one AV engines flag the domain, and AlienVault OTX references it in twelve threat‑intel pulses, reinforcing its malicious reputation. Nameservers are ns3.my-ndns.com and ns4.my-ndns.com. Evidence confirms that the infrastructure is currently operational and associated with phishing activity, but the exact payload or credential‑harvesting mechanism has not been publicly disclosed. Defenders should block DNS resolution to the domain and its IP, monitor outbound connections to the listed nameservers, and consider adding the domain to local blocklists. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection status.