telefiys[.]sbs

On 23 July 2026 the domain telefiys.sbs was observed as offline. The site previously returned a HTTP response with the page title “Messenger”, suggesting an attempt to lure users toward a messaging service. Registration data shows the domain was created on 14 June 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. DNS resolution points to 27.124.47.186, an address allocated to Rackip Consultancy Pte. LTD in Hong Kong.

The TLS certificate presented for the host is issued to “Telegram / *.local”, which does not match the domain name and is a typical indicator of mis‑configuration or deliberate obfuscation. Threat intelligence classifies the site as a credential phishing campaign. VirusTotal analysis recorded 13 detections out of 91 scanned security vendors, confirming that multiple scanners flag the domain as malicious. The domain appears on at least one public phishing blocklist and is specifically listed by the PhishDestroy service, reinforcing its malicious reputation. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, indicating a high likelihood of abuse.

The combination of a recent registration, mismatched SSL, low trust score, and multiple vendor detections points to a short‑lived phishing infrastructure designed to harvest credentials. No additional artifacts such as malware payloads or command‑and‑control endpoints have been publicly disclosed, leaving the exact phishing flow and targeted services uncertain. Defenders should block DNS resolution to 27.124.47.186, add telefiys.sbs to web‑filtering and email‑security blocklists, and monitor for any login attempts to services that may be impersonated by the “Messenger” title. Continuous re‑scanning of the domain is advised in case the site is re‑activated.