troevxzc[.]shop

Analysis of troevxzc.shop on July 19, 2026 identifies this domain as an active phishing site targeting users of the Messenger platform. The domain was registered through Nicenic International Group Co., Limited and resolves to IP address 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD. The site returns an HTTP 200 status, indicating it is live and serving content, with the page title explicitly labeled 'Messenger,' suggesting an attempt to mimic the legitimate service. Infrastructure reveals nameservers ns3.my-ndns.com and ns4.my-ndns.com, and an SSL certificate issued for 'Telegram' or '*.local,' which is inconsistent with the purported Messenger branding and may indicate reused or misconfigured certificates. Six of 91 security vendors on VirusTotal have flagged this domain, and it appears on one security blocklist. AlienVault OTX records the domain in three threat intelligence pulses, further corroborating malicious activity. Defenders should treat this domain as high-risk. The combination of a misleading page title, inconsistent SSL certificate, and detection by multiple security sources indicates a phishing campaign. No legitimate Messenger service is known to operate under this domain. Network-level blocking is recommended, and any credentials submitted to this site should be considered compromised. The domain remains active as of the report date, with no evidence of takedown or remediation.