teksheil[.]com

Analysis indicates that teksheil.com is currently serving a page with the title “Messenger” and responding with HTTP status 200. DNS resolution points to the IP address 27.124.47.186, which is assigned to Rackip Consultancy Pte. Ltd in Hong Kong. The authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. The TLS certificate presented is issued to “Telegram / *.local”, a mismatch that is commonly observed in malicious hosting environments. VirusTotal records show 17 of 91 security scanners flagging the domain, and it is actively listed on the PhishDestroy blocklist as well as one additional security blocklist. Registration information reveals the domain was provisioned through NICENIC INTERNATIONAL GROUP CO., LIMITED. These data points—mismatched certificate, multiple vendor detections, and blocklist presence—support a high‑risk classification for generic phishing activity. The exact phishing payload, targeted services, and any credential‑harvesting mechanisms have not been publicly disclosed, leaving the specific attack vector uncertain. Defenders should treat the domain as malicious, block network traffic to and from 27.124.47.186, enforce DNS sinkholing for teksheil.com, monitor for related login attempts, and consider adding the domain to existing email and web filtering policies until further intelligence is available.