teoixzec[.]co

Analysis indicates that the domain teoixzec.co is actively engaged in phishing operations targeting Messenger users, as evidenced by its page title and infrastructure characteristics. The domain resolves to the IP address 27.124.47.186, which is geolocated in Hong Kong and associated with Rackip Consultancy Pte. LTD. As of July 19, 2026, the domain remains operational, returning an HTTP 200 status and displaying the page title 'Messenger,' suggesting an intent to deceive users into believing the site is affiliated with the legitimate messaging platform. Infrastructure analysis reveals that teoixzec.co is hosted on an SSL certificate issued for Telegram or a wildcard *.local domain, which may indicate an attempt to obfuscate its true purpose or leverage misconfigured certificates. The domain appears on one security blocklist and has been flagged by 14 of 91 security vendors on VirusTotal, further corroborating its malicious classification. Additionally, AlienVault OTX records the domain in two threat intelligence pulses, indicating prior detection in active phishing campaigns. Defenders should prioritize blocking access to teoixzec.co at the network level, particularly for endpoints where Messenger or related services are in use. The domain's association with a known bulletproof hosting provider and its continued activity despite detection by multiple security vendors suggest persistence in its phishing operations. While the exact content and mechanics of the phishing kit remain unanalyzed, the combination of its page title, SSL certificate irregularities, and detection by security vendors confirms its high-risk status. No registration details or registrar information were provided, limiting further attribution at this time.