teleqwmk[.]com

The domain teleqwmk.com is currently active and serves a page titled "Messenger" over HTTPS, presenting a TLS certificate that references Telegram and a wildcard *.local name. DNS resolution points to IP 27.124.47.186, which is geolocated to Hong Kong and attributed to Rackip Consultancy Pte. LTD. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com. HTTP requests return a 200 status code, indicating the site is reachable. Reputation data shows that 17 of 91 security vendors on VirusTotal flag the domain as malicious, and AlienVault OTX includes it in two threat‑intel pulses. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service. The evidence points to a high‑risk generic phishing campaign that likely attempts to harvest Telegram credentials, although the exact content of the login page has not been publicly disclosed. Defenders should block both the domain and its associated IP address at network perimeters, monitor for related DNS queries, and consider adding the domain to internal deny lists. Continuous observation of the hosting infrastructure is recommended, as changes to the underlying IP or name servers could indicate a migration of the phishing operation.