teleoojmi[.]com

Analysis of www.teleoojmi.com shows a live HTTP service returning status code 200 and presenting a page titled “Messenger”. The domain resolves to the IPv4 address 27.124.47.186, which is geolocated to Hong Kong and is hosted by Rackip Consultancy Pte. Ltd. Registration information lists NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The TLS certificate presented is issued to “Telegram / *.local”, a mismatch that often indicates a mis‑configured or deliberately spoofed certificate. VirusTotal records indicate that 11 of 91 scanned security vendors have flagged the domain, and the site is currently listed on one public security blocklist. PhishDestroy has also added the domain to its block list, confirming active phishing activity. While the exact phishing payload or credential‑harvesting page has not been disclosed, the combination of a generic “Messenger” title, mismatched certificate, and multiple vendor detections strongly suggests a credential‑stealing operation. Defenders should block outbound connections to 27.124.47.186, add www.teleoojmi.com to URL filtering policies, and monitor for related malicious traffic. Continuous re‑assessment is advised, as the infrastructure may evolve or additional indicators could emerge.