telehbbvi[.]com

Analysis of telehbbvi.com shows an active high‑risk phishing infrastructure. The site returns HTTP 200 and presents a page titled “Messenger”. TLS is supplied by a certificate issued to “Telegram / *.local”, which is unusual for a legitimate Telegram service and suggests a spoofed identity. DNS resolution points to 27.124.47.186, an address attributed to a Hong Kong hosting provider (Rackip Consultancy Pte. LTD). The domain is delegated to ns3.my-ndns.com and ns4.my-ndns.com. Registration was performed via NICENIC INTERNATIONAL GROUP CO., LIMITED. Reputation data indicates that 11 of 91 scanning engines on VirusTotal have flagged the domain, and it appears on a single security blocklist, currently blocked by PhishDestroy. While the exact phishing payload and target user flow have not been publicly disclosed, the convergence of a legitimate‑sounding page title, mismatched TLS certificate, and multiple vendor detections confirms malicious intent. Defenders should block DNS resolution to 27.124.47.186, add the domain to URL filtering rules, monitor outbound connections to the identified nameservers, and enforce email gateway policies to detect any messages referencing the “Messenger” title. Continuous re‑scanning on VirusTotal and verification against additional blocklists are recommended to track any changes in the threat posture.