telebxkq[.]com

This domain, telebxkq.com, is identified as a high-risk phishing site impersonating the Messenger platform. Analysis indicates it employs generic phishing tactics to harvest user credentials through a fraudulent login interface, as evidenced by the page title "Messenger" and the use of an SSL certificate mimicking legitimate Telegram infrastructure. No specific drainer kit signatures have been confirmed, but the domain exhibits characteristics consistent with brand impersonation campaigns targeting social media users. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 11 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is currently blocked by InversionDNS. It resolves to the IP address 27.124.47.186 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 26, 2026, an anomalous future date suggesting potential registration data manipulation. Google Safe Browsing classifies this domain under the "SOCIAL_ENGINEERING" category, further confirming its deceptive nature. As of the latest assessment, telebxkq.com remains active and poses a continued threat to users. Immediate response actions include blacklisting the domain and IP across security gateways, invalidating the SSL certificate, and monitoring for related infrastructure. Despite these measures, the domain's persistence and active status necessitate heightened vigilance, particularly for users accessing Messenger or related services. Organizations are advised to update endpoint protection rules and educate users on recognizing phishing indicators such as mismatched SSL certificates and suspicious domain registrars.