telegozg[.]com

Analysis of telegozg.com indicates an active phishing domain targeting users through a Messenger-themed fraudulent page. The domain was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. As of July 19, 2026, telegozg.com resolves to the IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. Infrastructure analysis reveals the use of nameservers ns3.my-ndds.com and ns4.my-ndds.com, which have been observed in prior phishing campaigns. The SSL certificate is issued for Telegram and a wildcard subdomain (*.local), suggesting an attempt to lend legitimacy to the fraudulent site, though the exact content and functionality remain unconfirmed. The domain is flagged by Google Safe Browsing for social engineering and appears on one security blocklist, including detection by PhishDestroy. AlienVault OTX records the domain in three threat intelligence pulses, indicating prior malicious activity. VirusTotal reports 22 of 91 security vendors marking the domain as malicious, though the absence of additional context limits granular classification. The page title 'Messenger' aligns with common phishing tactics aimed at impersonating communication platforms, though no specific brand impersonation (e.g., Meta, Facebook) is confirmed in the available data. Defenders should treat telegozg.com as high-risk and prioritize blocking the domain and its associated IP (27.124.47.186) at the network level. Monitoring for related infrastructure, particularly domains using the same nameservers or registrar, is recommended to mitigate further exposure. Given the domain's active status and minimal detection coverage, user awareness campaigns should emphasize caution with unsolicited Messenger-related links.