telenbupx[.]com

This domain, telenbupx.com, is identified as a high-risk generic phishing threat actively impersonating the Messenger platform. Analysis indicates the domain employs social engineering tactics, likely targeting users through fraudulent login pages or credential harvesting schemes. The presence of a Telegram SSL certificate suggests an attempt to mimic legitimate encrypted communication services, increasing the likelihood of successful deception. No specific drainer kit signatures were detected in initial scans, but the domain aligns with common phishing infrastructure patterns. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 27.124.47.186, which has been flagged in prior phishing campaigns. VirusTotal reports 16 out of 95 security vendors marking the domain as malicious, while Google Safe Browsing explicitly flags it for SOCIAL_ENGINEERING. The domain appears on two security blocklists, InversionDNS and BLP-Malware, further corroborating its malicious intent. The page title, 'Messenger,' reinforces its impersonation of the legitimate platform. As of the latest assessment, telenbupx.com remains active, posing an ongoing risk to users who may encounter it through phishing links or malicious advertisements. Immediate response actions include blacklisting the domain across enterprise security tools, blocking the associated IP address (27.124.47.186), and monitoring for related infrastructure. Despite these measures, the domain's continued operation and low detection rate among some vendors (16/95) indicate a persistent threat. Users are advised to verify domain authenticity before entering credentials and to report suspicious links to security teams for further analysis.