teleiyjmg[.]com

Analysis of www.teleiyjmg.com shows an active infrastructure that mimics Telegram’s messenger service. The site resolves to 27.124.47.186, a server located in Hong Kong and operated by Rackip Consultancy Pte. LTD. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain uses the authoritative nameservers ns3.my-ndns.com and ns4.my-ndns.com. The HTTP response returns status 200, and the presented TLS certificate is issued to “Telegram / *.local”, reinforcing the impression of a legitimate Telegram endpoint. VirusTotal reports that 10 of 91 scanned security vendors flag the domain, indicating moderate detection across the community. The domain appears on one public blocklist and is already blocked by PhishDestroy, confirming its classification as a high‑risk phishing resource. Current evidence does not reveal the full content of the site beyond the page title “Messenger,” so the exact credential‑capture mechanisms remain unknown. Defenders should add the domain and its resolving IP to DNS and URL filtering policies, monitor for any related C2 traffic from the Hong Kong host, and consider sinkholing the domain to disrupt further abuse. Continuous re‑scanning of the site is recommended to capture any evolution of malicious payloads.