telshksg[.]sbs

Analysis indicates that the domain telshksg.sbs is an active phishing site targeting users of the Messenger platform, as evidenced by its page title explicitly labeled 'Messenger.' Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 27.124.47.186, which is geolocated in Hong Kong and associated with Rackip Consultancy Pte. LTD. Infrastructure analysis reveals the use of nameservers ns3.my-nddns.com and ns4.my-nddns.com, a pattern observed in other recently identified phishing campaigns. The SSL certificate is issued for 'Telegram' and a wildcard for *.local, which does not align with the purported Messenger branding, suggesting either misconfiguration or deliberate obfuscation of the site's true purpose. As of July 19, 2026, the domain remains active, returning an HTTP 200 status code, and is flagged by one security blocklist, specifically PhishDestroy. VirusTotal reports 15 detections out of 91 security vendors, confirming its malicious classification. The discrepancy between the page title (Messenger) and the SSL certificate (Telegram) introduces uncertainty regarding the exact brand being impersonated, though the primary focus appears to be credential harvesting under the guise of a messaging service. Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Further investigation into the hosting provider and registrar may reveal additional linked infrastructure, though no direct attribution to a specific threat actor or campaign is currently available.