teoutn[.]sbs

The domain teoutn.sbs is identified as a phishing site designed to harvest Telegram login credentials. Analysis classifies this as a generic_phishing threat with an elevated risk level. As of the latest assessment, the domain has been taken offline, though prior activity indicates malicious intent targeting users of the Telegram messaging platform. Infrastructure analysis reveals the domain was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 216.150.1.1 and has been flagged by 16 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100. The SSL certificate associated with teoutn.sbs is issued under the name Telegram, further indicating an attempt to mimic legitimate Telegram services. The page title displayed during interaction was 'Loading...', a common tactic to delay user suspicion while malicious scripts execute. Current status confirms teoutn.sbs is offline, though similar domains may emerge using comparable infrastructure. Organizations and individuals are advised to block the domain and its associated IP (216.150.1.1) at the network level. Users should verify SSL certificates directly through official Telegram channels before entering credentials. Security teams are recommended to monitor for domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED with recent creation dates, as this registrar has been linked to multiple phishing campaigns. Implementing multi-factor authentication (MFA) for Telegram accounts can mitigate the impact of credential theft.