telemoyn[.]com

Analysis of telemoyn.com indicates an active generic phishing operation targeting users through a page titled “Messenger”. The domain is hosted on nameservers ns3.my-ndns.com and ns4.my-ndns.com and resolves to the IPv4 address 27.124.47.186, which is registered to Rackip Consultancy Pte. LTD in Hong Kong. The SSL certificate presented is issued to “Telegram / *.local”, a mismatch that may be used to obscure the true service. Registration was performed via NICENIC INTERNATIONAL GROUP CO., LIMITED. The site returns HTTP 200 responses and is flagged by Google Safe Browsing for social engineering. AlienVault OTX lists the domain in two threat‑intel pulses, and VirusTotal records 18 detections out of 91 scanners. It is presently blocked by PhishDestroy and appears on one external blocklist. The high risk rating reflects the combination of active hosting, valid TLS, and multiple vendor detections. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content has been disclosed. Defenders should add the domain to outbound‑filter deny lists, monitor DNS queries for the associated IP, and enforce TLS inspection to capture any credential submission. Continuous re‑scanning with VirusTotal and inclusion in internal threat‑intel feeds is recommended to track any changes in detection counts or infrastructure.