teoipzmn[.]co

Analysis of teoipzmn.co as of July 19, 2026, indicates a high-risk phishing domain actively targeting users through a fraudulent Messenger-themed page. The domain is flagged by 21 of 91 security vendors on VirusTotal and appears on one security blocklist, with Google Safe Browsing specifically classifying it as social engineering. Infrastructure analysis reveals the domain resolves to IP 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD. The SSL certificate is issued for Telegram and a wildcard *.local domain, which does not align with the Messenger page title, suggesting misdirection or reuse of compromised certificates. The domain has been included in three threat intelligence pulses on AlienVault OTX, reinforcing its association with malicious activity. The HTTP status returns 200, confirming the site is operational and serving content. While the exact phishing kit or payload is not yet analysed, the combination of the Messenger page title, social engineering classification, and detection by multiple security vendors strongly indicates an active credential harvesting or account takeover campaign. Defenders should treat this domain as confirmed malicious and implement blocking at the DNS, proxy, or firewall level. Given the SSL certificate mismatch and hosting in a high-risk region, additional scrutiny of related infrastructure is recommended. No legitimate use case is identified, and user access should be restricted pending further investigation or takedown.