telebtke[.]com

Analysis of telebtke.com as of July 19, 2026 indicates the domain is actively hosting a generic phishing campaign and is classified as high risk. The site returns HTTP 200 and presents a page title of “Messenger,” suggesting it may be used to lure victims into a messaging‑based credential capture flow. Infrastructure details show the domain resolves to IP 27.124.47.186, which is geolocated to Hong Kong and owned by Rackip Consultancy Pte. Ltd. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com, and registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. The TLS certificate presented is issued to “Telegram / *.local,” a mismatch that further signals malicious intent. VirusTotal scans have flagged the domain by 11 of 91 security vendors, and AlienVault OTX references it in two separate threat pulses. It appears on one public blocklist and is explicitly blocked by PhishDestroy. Defenders should immediately add telebtke.com and its resolved IP to deny‑list rules on perimeter firewalls, web proxies, and endpoint protection solutions. Monitoring of DNS queries for the associated name servers is advised to detect any lateral use of the same hosting infrastructure. Because the payload and exact phishing landing page content have not been captured, further sandbox analysis of any downloaded artifacts from the site is recommended to determine the full exploit chain. Continuous threat‑intel feeds should be consulted for updates, as the domain remains active and may evolve its tactics.