teleymmob[.]com

This domain is flagged as a high-risk credential phishing site targeting users of messaging platforms. Analysis indicates the site impersonates Messenger, a common tactic to deceive victims into submitting login credentials or personal information. The domain’s infrastructure and design are engineered to closely resemble legitimate communication services, increasing the likelihood of successful compromise. Infrastructure analysis reveals the following technical indicators: the domain teleymmob.com resolves to IP address 27.124.47.186 and was registered on May 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The SSL certificate is falsely issued under the name Telegram, a deliberate attempt to lend credibility to the phishing operation. VirusTotal reports 11 out of 95 security vendors have flagged this domain as malicious, with detection rates likely to rise as awareness increases. The page title, Messenger, further supports the phishing narrative, aligning with the domain’s deceptive intent. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address at the network perimeter. Security teams should update endpoint protection rules to detect and prevent access to teleymmob.com, particularly on systems where messaging applications are in use. User awareness training should emphasize the risks of credential submission on unverified platforms, especially those mimicking popular services. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED may uncover additional phishing infrastructure linked to this campaign. Logs from web proxies and DNS resolvers should be reviewed for historical connections to 27.124.47.186 to identify potential prior compromises.