telepotz[.]com

telepotz.com is currently active and serves a page titled “Messenger”. The site presents an SSL certificate that references Telegram and a wildcard *.local domain, which does not match the public hostname and suggests a mis‑configured or deliberately misleading certificate. DNS resolution points to 27.124.47.186, an address registered to Rackip Consultancy Pte. Ltd in Hong Kong. The domain is delegated to ns3.my-ndns.com and ns4.my-ndns.com and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. Reputation data shows the domain appears on one public blocklist and is listed by PhishDestroy as blocked. VirusTotal scans have flagged the domain in 15 of 91 security engines, and AlienVault OTX includes it in two threat‑intel pulses. These indicators collectively point to a high‑risk generic phishing operation, although the exact payload or credential‑harvesting technique has not been publicly disclosed. Defenders should block network traffic to 27.124.47.186 and to the domain itself, monitor DNS queries for telepotz.com, and consider adding the domain to internal blacklists. Continuous re‑scanning is advised to capture any changes in malicious content.