telefvwr[.]com

The domain telefvwr.com is currently active and serves content with the page title “Messenger”. It resolves to the IPv4 address 27.124.47.186, which is geolocated to Hong Kong and attributed to Rackip Consultancy Pte. Ltd. The domain’s authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com, and registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. An HTTPS connection presents a certificate issued to “Telegram” with a wildcard *.local name, suggesting an attempt to masquerade as a Telegram‑related service. HTTP requests receive a 200 OK response, indicating the site is reachable. Six of ninety‑one VirusTotal scanners have flagged the domain, and it appears on one external blocklist that is enforced by PhishDestroy. AlienVault OTX references the domain in two separate threat‑intelligence pulses. The combined evidence points to a high‑risk generic phishing operation that likely aims to harvest credentials or deliver malicious payloads under the guise of a messaging platform. Defenders should block outbound connections to 27.124.47.186, add telefvwr.com to domain‑based deny lists, monitor DNS queries for the domain and its name‑server hosts, and inspect any TLS traffic for the anomalous *.local certificate. Because the site’s internal page structure and payloads have not been publicly disclosed, additional sandbox analysis of retrieved content is recommended to determine the exact malicious behaviour.