telelcai[.]com

Analysis as of July 19, 2026 indicates that telelcai.com is actively hosting a malicious web page whose title is reported as "Messenger." The domain resolves to the IPv4 address 27.124.47.186, an address registered to Rackip Consultancy Pte. Ltd in Hong Kong. The TLS certificate presented by the server is issued to "Telegram / *.local," which does not match the domain name and suggests an attempt to obscure the true service identity. Registration data show that the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. HTTP requests return a 200 status code, confirming the site is reachable. The URL is listed on a single security blocklist and is blocked by the PhishDestroy platform. Independent attribution sources corroborate the threat: AlienVault OTX references include two pulses that mention telelcai.com, and VirusTotal reports that 15 of 91 scanned security engines flag the domain as malicious. While the exact phishing kit or credential‑harvesting method has not been captured, the convergence of mismatched TLS, active hosting, multiple vendor detections, and inclusion in threat‑intel feeds underscores a high‑risk profile. Defenders should block the domain at network perimeter, add the associated IP address to deny lists, monitor DNS queries for the listed name servers, and consider updating endpoint protection rules to flag any outbound connections to telelcai.com. Further investigation of the page content is recommended to identify any specific credential‑phishing payloads that may be delivered.