teleekps[.]com

Analysis conducted on July 19, 2026 identifies teleekps.com as an active phishing domain targeting users of the Messenger platform. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IP address 27.124.47.186, hosted by Rackip Consultancy Pte. LTD in Hong Kong. Infrastructure analysis reveals the use of nameservers ns3.my-nds.com and ns4.my-nds.com, which have been associated with other phishing campaigns in recent months. The site returns an HTTP 200 status, indicating an operational server, and displays the page title 'Messenger,' suggesting an attempt to impersonate the legitimate messaging service. While the exact content of the phishing page remains unanalyzed, the presence of this title aligns with credential-theft tactics commonly employed against social media and communication platforms. The SSL certificate is issued for 'Telegram' and includes a wildcard for *.local, which does not match the domain name and may indicate misconfiguration or deliberate obfuscation. Security vendor detection on VirusTotal shows 15 of 91 engines flagging the domain as malicious, a detection rate consistent with confirmed phishing infrastructure. Additionally, the domain appears on at least one security blocklist, and PhishDestroy has implemented active blocking measures against it. These indicators, combined with the domain's registration and hosting patterns, support a classification of high-risk phishing activity. Defenders are advised to treat teleekps.com as a confirmed threat and implement blocking at the DNS, IP, and URL levels. Network administrators should monitor for connections to 27.124.47.186 and the associated nameservers, as these may serve as indicators of compromise. Given the domain's continued activity, users encountering links to this site should be instructed to avoid interaction and report the URL to their security teams for further investigation.