teltrt[.]com

This domain, teltrt.com, is flagged as a high-risk generic phishing threat targeting users through a fraudulent Messenger interface. Analysis indicates the site mimics legitimate messaging platforms to harvest login credentials, session tokens, or personal data. The page title explicitly displays 'Messenger,' suggesting an intent to deceive users into believing they are interacting with an official service. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with credential-phishing campaigns observed in recent months. Technical indicators reveal multiple red flags. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 27.124.47.186. Created on June 13, 2026, the domain exhibits an anomalous future registration date, likely due to typosquatting or domain spoofing techniques. Google Safe Browsing categorizes it under SOCIAL_ENGINEERING, while VirusTotal reports 15 out of 95 security vendors detecting malicious activity. The domain appears on one security blocklist and is currently blocked by InversionDNS. The SSL certificate is falsely attributed to 'Telegram,' further attempting to lend legitimacy to the fraudulent site. As of the latest verification, teltrt.com remains active and poses a significant risk to unsuspecting users. Response actions should include immediate blacklisting in enterprise and consumer security tools, DNS-based blocking, and user awareness campaigns highlighting the domain's fraudulent nature. Despite existing detections, the domain's persistence and SSL spoofing tactics indicate a moderate to high likelihood of evasion, necessitating continuous monitoring. Users are advised to verify domain authenticity before entering credentials and to report any interaction with the site to their security teams for further analysis.