teksxwme[.]com

Analysis of the domain teksxwme.com shows that it is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IPv4 address 27.124.47.186, which is hosted in Hong Kong by Rackip Consultancy Pte. LTD. The authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. An HTTP request to the host returns a 200 OK response and the page title reported is "Messenger". The TLS certificate presented is issued to Telegram and covers the wildcard *.local, a mismatch that is typical of malicious infrastructure. The domain has been listed on a public blocklist and is actively blocked by PhishDestroy. VirusTotal scans indicate that 13 of 91 security vendors have flagged the domain, reinforcing the high‑risk assessment. The domain remains active as of the report date, July 20, 2026. While the exact phishing payload or targeted brand is not disclosed, the observable indicators (mismatched certificate, generic messenger title, and multiple security vendor detections) suggest a generic phishing campaign. Defenders should consider adding the domain and its resolving IP to deny‑list rules, monitor DNS queries for the associated nameservers, and employ sink‑hole techniques where feasible. Continuous re‑evaluation is advised to capture any changes in the site content or additional detection signals.