teleukpfh[.]com

Analysis indicates that the domain www.teleukpfh.com is actively engaged in credential phishing targeting users of a messaging platform, as evidenced by its page title 'Messenger' and classification under 'Credential Phishing' in threat intelligence sources. Registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 27.124.47.186, hosted on AS152194 (CTG Server Limited) in Hong Kong. Infrastructure analysis reveals the use of nameservers ns3.my-nddns.com and ns4.my-nddns.com, while its SSL certificate is issued for 'Telegram' and a wildcard subdomain *.local, which may suggest an attempt to mimic legitimate communication services. As of July 12, 2026, the domain returns an HTTP 200 status, confirming its operational status. Detection metrics from security vendors indicate partial confirmation of malicious activity, with 7 out of 91 engines flagging the domain. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. While the exact content and functionality of the phishing page remain unanalyzed, the combination of infrastructure, registration details, and detection data confirms its role in credential harvesting. Defenders are advised to treat this domain as malicious, implement network-level blocking, and monitor for related indicators of compromise. Additional investigation into the hosting provider and registrar may reveal further connections to broader phishing campaigns.