ticekcoz[.]shop

Analysis of the domain ticekcoz.shop indicates active phishing infrastructure targeting users of the Messenger platform. The domain, registered under an unknown registrar, resolves to the IP address 27.124.47.186, hosted by Rackip Consultancy Pte. LTD in Hong Kong. The page title explicitly displays 'Messenger,' suggesting an attempt to impersonate the legitimate messaging service. As of July 19, 2026, the domain remains operational, returning an HTTP 200 status code, which confirms its accessibility. Technical indicators reveal limited but actionable intelligence. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 14 of 91 security vendors on VirusTotal. Additionally, AlienVault OTX includes the domain in two threat intelligence pulses, further corroborating its malicious classification. The SSL certificate, issued for 'Telegram' and a wildcard *.local domain, does not align with the purported Messenger branding, which may serve as a red flag for defenders. Infrastructure analysis reveals no additional contextual details, such as the use of a known phishing kit or association with broader campaigns. The exact content and functionality of the site remain unanalyzed, though the combination of the 'Messenger' page title and the domain's detection history strongly suggests credential harvesting or account compromise objectives. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related infrastructure, and alert users to potential phishing attempts originating from this source. Further investigation into the hosting provider and registrar may yield additional mitigation opportunities.