teolwwpd[.]sbs

Analysis indicates that the domain teolwwpd.sbs is actively serving phishing content as of July 20, 2026. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. Nameservers ns3.my-ndns.com and ns4.my-ndns.com are associated with the domain, a configuration commonly observed in phishing infrastructure. The page title 'Messenger' suggests an attempt to mimic a legitimate messaging platform, though the exact content and targeting remain unconfirmed due to the absence of deeper forensic analysis. Security vendors have flagged teolwwpd.sbs, with 6 out of 91 engines on VirusTotal detecting it as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued for 'Telegram' and '*.local', which may indicate an effort to lend false legitimacy or obfuscate the true nature of the site. The HTTP status code 200 confirms the page is accessible, and no takedown has been observed as of the report date. Defenders should treat this domain as high-risk phishing infrastructure. Network-level blocking of 27.124.47.186 and the domain itself is recommended, along with monitoring for related subdomains or newly registered lookalike domains under the same nameservers. Further investigation into the SSL certificate issuer and any associated Telegram-themed lures may provide additional context, though no direct evidence of Telegram-specific targeting is present in the current data. The domain’s continued activity underscores the need for real-time detection and response measures.