telehgpx[.]com

telehgpx.com is currently active and has been identified as a generic phishing site. The domain resolves to 27.124.47.186, an address registered to Rackip Consultancy Pte. LTD in Hong Kong. Registration data shows the registrar as NICENIC INTERNATIONAL GROUP CO., LIMITED, and the SSL certificate presented is issued to Telegram with a wildcard for *.local, which is atypical for a legitimate service. HTTP requests return status 200 and the page title reported is “Messenger”. The domain appears on one security blocklist and has been flagged by five of ninety‑one VirusTotal scanners. Nameserver records point to ns3.my-ndns.com and ns4.my-ndns.com. PhishDestroy has already blocked the domain. At this time the specific content hosted on the site and the intended victim profile have not been publicly disclosed, so the full scope of the phishing campaign remains uncertain. Defenders should add telehgpx.com to deny lists, monitor DNS queries for the associated IP and nameservers, and enforce TLS inspection to detect the anomalous Telegram *.local certificate. Continuous threat‑intel feeds should be consulted for any updates on the domain’s activity.