tekstbqi[.]com

Analysis of the domain tekstbqi.com, observed on July 20, 2026, indicates active malicious activity. The site resolves to IP 27.124.47.186, an address registered to Rackip Consultancy Pte. LTD in Hong Kong. DNS resolution is served by ns3.my-ndns.com and ns4.my-ndns.com, and the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The web server returns HTTP 200 and presents a page titled “Messenger”. The SSL certificate presented is issued to Telegram and covers *.local, a mismatch that suggests an attempt to masquerade as a legitimate messaging service. Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has already blocked the domain. VirusTotal reports 13 detections out of 91 scanning engines, confirming that a subset of security products consider the site malicious. The evidence points to a high‑risk phishing campaign, likely aimed at harvesting credentials for messaging platforms. Uncertainty remains regarding the exact phishing kit or the full extent of victim outreach, as no additional payload details are available. Defenders should block the domain and its resolving IP at network perimeters, monitor DNS queries for the associated nameservers, and update endpoint filters with the Google Safe Browsing and PhishDestroy indicators. Continuous observation of the IP reputation and any future changes to the TLS certificate is recommended to detect possible infrastructure shifts.