toicabct[.]sbs

toicabct.sbs is an active phishing infrastructure observed on July 19, 2026. The domain resolves to the IPv4 address 27.124.47.186, which is hosted in Hong Kong and assigned to Rackip Consultancy Pte. Ltd. Authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com, and the registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. The site returns HTTP 200 and presents a page titled “Messenger”, suggesting an attempt to masquerade as a legitimate messaging service. The SSL certificate presented is issued to “Telegram / *.local”, a mismatch that further indicates a fraudulent setup. Threat intelligence from AlienVault OTX lists the domain in two separate pulses, and VirusTotal records 17 of 91 scanners flagging the domain as malicious. The domain is already blocked by the PhishDestroy feed and appears on one additional security blocklist. Infrastructure analysis confirms a typical phishing pattern: a short‑lived domain, foreign hosting, and mismatched TLS credentials. What remains uncertain is the exact payload delivered to victims and whether the site hosts credential‑stealing forms or redirects to additional malicious hosts. Defenders should add the domain and its resolved IP to deny‑list rules, monitor DNS queries for the associated name servers, and enforce TLS inspection to detect the inconsistent certificate. Continuous threat‑intel correlation is recommended to capture any new indicators that may emerge from this campaign.