teletxcy[.]com

This domain, teletxcy.com, is confirmed as an active phishing site specifically targeting users of the Messenger platform. Analysis indicates it operates as a credential harvesting page, impersonating Meta's messaging service to deceive victims into submitting login credentials. The page title explicitly displays 'Messenger,' reinforcing the social engineering tactic. Current infrastructure and behavioral patterns align with known phishing campaigns targeting social media platforms. Infrastructure analysis reveals the domain was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.97.3 and employs Cloudflare with HTTP/3 support, a common evasion technique to obscure malicious activity. Despite zero detections from 95 VirusTotal vendors, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score of 1/100 further corroborates its malicious classification. SSL certification is provided by Google Trust Services, which, while legitimate, is frequently abused by threat actors to lend false credibility to phishing sites. As of the latest verification, teletxcy.com remains active and continues to host the phishing page. Organizations and individuals are advised to block the domain at the DNS or network level, particularly in environments where access to Messenger or Meta services is permitted. Endpoint protection systems should be updated to include this domain in their blocklists, and users should be educated to recognize the domain name and associated phishing tactics. Monitoring for connections to 188.114.97.3 or related Cloudflare IP ranges may help identify compromised systems attempting to communicate with this infrastructure.