tgelrhgb[.]shop

The domain tgelrhgb.shop is currently active and has been identified as part of a high-risk phishing campaign, specifically impersonating the Messenger platform based on the page title 'Messenger' found during investigation. VirusTotal reports that 15 out of 91 security vendors have flagged this domain as malicious. Additionally, it is blocked by PhishDestroy and appears on at least one public security blocklist, indicating consistent detection across multiple threat intelligence sources.

Infrastructure analysis reveals that tgelrhgb.shop resolves to IP address 27.124.47.186, hosted in Hong Kong through Rackip Consultancy Pte. LTD. The domain's SSL certificate references 'Telegram / *.local', which, combined with the Messenger page title, may suggest broader use of messaging service brands to lure users, though only 'Messenger' is directly referenced in available evidence. The domain uses nameservers ns3.my-ndns.com and ns4.my-ndns.com and is registered via Nicenic International Group Co., Limited. AlienVault OTX includes this domain in two separate threat intelligence pulses, further supporting its malicious classification.

The HTTP status 200 response confirms the domain is currently serving content. However, the exact nature or method of the phishing attempt beyond brand impersonation has not yet been analyzed. Defenders should prioritize blocking this domain, monitor for related infrastructure, and warn users of campaigns leveraging Messenger branding for phishing. Continuous monitoring is advised due to the domain's active status and persistent presence in threat intelligence sources as of July 19, 2026.