teleikbo[.]com

This domain, teleikbo.com, is actively flagged as a high-risk phishing infrastructure impersonating a Messenger login portal, as indicated by its page title 'Messenger' and confirmed by multiple threat intelligence sources. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD. Analysis reveals 17 of 91 security vendors on VirusTotal have detected malicious activity associated with this domain, and it appears on at least one security blocklist, specifically PhishDestroy. The SSL certificate is issued for Telegram or a local domain, which may indicate an attempt to mislead users or evade detection. Infrastructure analysis shows the domain uses nameservers ns3.my-nddns.com and ns4.my-nddns.com, a pattern observed in other phishing campaigns. AlienVault OTX records link this domain to two threat intelligence pulses, suggesting it is part of a broader malicious operation. The HTTP status of 200 confirms the site is currently accessible, and no takedown or sinkholing activity has been observed as of July 19, 2026. Defenders should treat this domain as an active threat. Immediate actions include blocking the domain and its resolving IP at the network perimeter, adding it to endpoint protection denylists, and monitoring for any internal connections to 27.124.47.186 or the associated nameservers. Given the domain's registration and hosting patterns, it is likely part of a larger phishing kit or bulletproof infrastructure. Further analysis of the site's content is recommended to identify specific payloads or credential harvesting techniques, though no visual or functional details are currently available. If Messenger credentials or similar sensitive data are handled within the organization, user awareness and multi-factor authentication enforcement should be reinforced to mitigate potential compromise.