telehklb[.]com

This domain, telehklb.com, is actively flagged as a high-risk phishing site targeting users through a Messenger-themed interface. Analysis indicates the domain resolves to 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong, with nameservers ns3.my-ndns.com and ns4.my-ndns.com. The SSL certificate is issued for Telegram or a wildcard *.local domain, which is atypical for legitimate messaging services and suggests an attempt to mimic secure communication channels. The page title 'Messenger' further aligns with social engineering tactics aimed at users of popular messaging platforms. Security vendors have detected malicious activity associated with this domain, with 13 of 91 engines on VirusTotal flagging it as harmful. Additionally, the domain appears in two AlienVault OTX threat intelligence pulses and is blocked by PhishDestroy, confirming its presence on at least one security blocklist. The registration details point to NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive domains. While the exact phishing kit or payload remains unconfirmed, the infrastructure and indicators strongly suggest credential harvesting or account takeover attempts. Defenders should treat this domain as an active threat. Immediate actions include blocking the domain and its resolving IP at the network perimeter, monitoring for connections to 27.124.47.186, and reviewing logs for any user interactions with telehklb.com. Given the SSL certificate's association with Telegram, organizations should also alert users to potential phishing attempts impersonating messaging services. Further analysis of the site's content, if accessible, may reveal additional indicators of compromise or targeted brands.