teleqczl[.]com

Analysis of www.teleqczl.com shows an active generic phishing infrastructure targeting users of messenger‑type services. The domain resolves to IP 27.124.47.186, which is geolocated to Hong Kong and is hosted by Rackip Consultancy Pte. LTD. DNS resolution is served by ns3.my-ndns.com and ns4.my-ndns.com, and registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. The site presents an HTTP 200 response and serves an SSL certificate issued to Telegram for the wildcard *.local, indicating a certificate mismatch that may be used to evade detection. The page title returned is "Messenger," suggesting the campaign attempts to lure victims by impersonating a messenger application, though the exact brand is not confirmed. The domain appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal analysis records nine of ninety‑one security vendors flagging the domain as malicious, reinforcing the suspicion of phishing activity. Current intelligence lacks detailed content analysis of the landing page, so the precise phishing vector remains uncertain. Defenders should block the domain and its associated IP at perimeter defenses, monitor DNS queries for the listed nameservers, and add the indicator to internal threat feeds. Continuous observation of any changes to the SSL certificate or hosting location is recommended to detect potential infrastructure shifts.