teleehfgo[.]com

teleehfgo.com is an active credential‑phishing site first observed on 21 May 2026. The domain resolves to 27.124.47.186, an address assigned to a Hong‑Kong network operated by Rackip Consultancy Pte. Ltd. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED and the authoritative name servers are ns3.my‑ndns.com and ns4.my‑ndns.com. The site presents an HTTPS certificate that references “Telegram / *.local”, and the page title returned by the server is “Messenger”, indicating an attempt to masquerade as the Telegram messaging service. HTTP requests return a 200 status code, and the domain has been listed on at least one security blocklist and is currently blocked by PhishDestroy. Reputation scoring from Gridinsoft is 0 / 100, and Google Safe Browsing classifies the URL as social‑engineering. VirusTotal reports 13 of 91 scanners flagging the domain as malicious. While the exact page content has not been released, the combination of a Telegram‑related certificate, messenger‑oriented title, and high‑risk credential‑phishing classification suggests the site is likely used to harvest Telegram account credentials. Defenders should deny outbound connections to 27.124.47.186, add teleehfgo.com to URL filtering and DNS blocklists, monitor for login attempts to Telegram services from internal users, and educate users to verify the legitimacy of any Telegram login prompts. Ongoing surveillance of the IP and associated name servers is recommended to detect any pivoting activity.