taoiebxr[.]shop

Analysis of taoiebxr.shop indicates a high-risk phishing domain targeting users of the Messenger platform. The domain, registered through Nicenic International Group Co., Limited, resolves to IP 27.124.47.186 (Rackip Consultancy Pte. LTD, Hong Kong) and returns an HTTP 200 status, suggesting an active operational page. The SSL certificate is issued for 'Telegram' and a wildcard *.local domain, which does not align with the page title 'Messenger,' raising suspicion of misrepresentation or spoofing. Infrastructure analysis reveals nameservers ns3.my-ndns.com and ns4.my-ndns.com, a pattern observed in other phishing campaigns. As of July 19, 2026, the domain is flagged by 15 of 91 security vendors on VirusTotal and appears in 2 AlienVault OTX threat intelligence pulses, alongside one security blocklist entry. The exact content or phishing kit in use has not been analyzed, but the combination of infrastructure, SSL mismatch, and detection by multiple vendors confirms malicious intent. Defenders should block the domain and IP at perimeter controls, monitor for internal connections to 27.124.47.186, and investigate any user reports of Messenger-related phishing attempts originating from this domain.