tgelhtzs[.]shop

Analysis on tgelhtzs.shop shows the site is actively serving HTTP 200 responses and presents a page title of "Messenger". The domain resolves to IP 27.124.47.186, which GeoIP attributes to Hong Kong and is owned by Rackip Consultancy Pte. LTD. Registration records indicate the domain was created through Nicenic International Group Co., Limited. The authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com, and the TLS certificate presented is issued to "Telegram / *.local", a mismatch that is typical for fraudulent services. VirusTotal scans have flagged the domain by 6 of 91 security vendors, and AlienVault OTX lists it in two separate threat‑intel pulses. The domain is currently blocked by PhishDestroy and appears on one public blocklist. These indicators collectively point to a high‑risk generic phishing operation. The exact content of the hosted page has not been examined, leaving the specific credential‑capture mechanism uncertain. Defenders should add 27.124.47.186 and tgelhtzs.shop to network‑level deny lists, monitor DNS queries for the domain, and ensure that any inbound traffic to the IP is dropped. Continuous re‑scanning with sandbox or URL analysis tools is recommended to confirm the payload if the site becomes reachable.