teolnyxq[.]sbs

The domain teolnyxq.sbs is currently active and serves HTTP content with a 200 response. The page title returned is “Messenger”, and the TLS certificate presented is issued to “Telegram / *.local”, suggesting an attempt to masquerade as the Telegram messenger service. Registration information shows the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the IPv4 address 27.124.47.186, which is hosted in Hong Kong and associated with Rackip Consultancy Pte. LTD. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. VirusTotal has flagged the domain in five of ninety‑one scanners, indicating that multiple security products have observed suspicious characteristics. The domain is listed on a public phishing blocklist and has been blocked by the PhishDestroy service, confirming its classification as a phishing site. No additional forensic details such as payloads, credential‑stealing forms, or redirection behavior have been disclosed. Defenders should block DNS resolution for teolnyxq.sbs and any subdomains, enforce URL filtering to deny HTTP traffic to the associated IP address, and monitor for outbound connections to the host. Because the TLS certificate mimics Telegram, email and messaging security gateways should treat any communication referencing this domain as malicious. Continuous monitoring of the IP reputation and periodic rescanning on sandbox platforms are recommended to capture any evolving payloads.