teleltvrg[.]com

The domain teleltvrg.com is currently active and classified as high‑risk generic phishing. Analysis shows the site returns HTTP 200 and presents a page title of “Messenger”. The SSL certificate is issued to Telegram and includes a wildcard *.local, suggesting an attempt to leverage the Telegram brand. Registration data lists NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, while the domain resolves to IP 27.124.47.186, which is geolocated to Hong Kong and associated with Rackip Consultancy Pte. Ltd. The host is served from nameservers ns3.my-ndns.com and ns4.my-ndns.com. Threat intelligence sources have observed the domain in three AlienVault OTX pulses and it is listed on at least one security blocklist. PhishDestroy has already blocked the domain, and 19 of 91 VirusTotal scanners have flagged it as malicious. The exact content of the landing page has not been publicly disclosed, so the specific tactics used (e.g., credential harvesting forms) remain uncertain. Defenders should add teleltvrg.com to web filtering and DNS blocklists, monitor outbound traffic for connections to the associated IP, and enforce multi‑factor authentication for any services that could be targeted by a Telegram‑styled credential‑theft campaign. Continued surveillance is advised to detect any changes in hosting or payload delivery.