tewgift[.]sbs

Analysis of tewgift.sbs shows an active phishing infrastructure targeting users of the Telegram messenger service. The site returns HTTP 200 responses and presents a page title of “Messenger,” while the presented SSL certificate is issued to “Telegram / *.local,” indicating an attempt to masquerade as a legitimate Telegram login portal. The domain resolves to IP address 27.124.47.186, which is geolocated to Hong Kong and is associated with Rackip Consultancy Pte. LTD. Nameserver records point to ns3.my-ndns.com and ns4.my-ndns.com. Registration details list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar. Threat intelligence indicates that 16 of 91 VirusTotal scanners have flagged the domain, and it is currently listed on a security blocklist and blocked by PhishDestroy. The combination of a valid‑looking TLS certificate, a generic “Messenger” title, and a high‑risk classification suggests the site is being used to harvest credentials or deliver further malicious payloads. Defenders should immediately block outbound connections to 27.124.47.186 and add tewgift.sbs to URL filtering policies. Network monitoring should be tuned to detect TLS handshakes to the “*.local” certificate chain, and any authentication attempts to Telegram services originating from internal hosts should be scrutinized. Continuous threat feed updates are recommended to capture any new indicators associated with this domain, and incident response teams should be prepared to investigate potential credential compromise if users have interacted with the site.