telegpic[.]sbs

This domain is flagged as a high-risk credential theft operation targeting users of the Messenger platform. Analysis indicates the site employs brand impersonation techniques to harvest login credentials, posing significant risk to individuals and organizations relying on secure communication channels. Infrastructure analysis reveals the domain telegpic.sbs was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to the IP address 27.124.47.186 and is detected by 12 out of 95 security vendors on VirusTotal. The domain appears in one threat intelligence pulse on AlienVault OTX, further confirming its malicious classification. The page title "Messenger" suggests an attempt to deceive users into believing they are interacting with the legitimate service. To mitigate risks associated with this credential theft campaign, users should avoid accessing telegpic.sbs and report any suspicious login prompts to their security teams. Organizations are advised to block the domain and its resolving IP at the network perimeter. Multi-factor authentication should be enforced for all accounts to reduce the impact of potential credential compromise. Security teams should monitor for unusual login attempts and educate users on identifying phishing attempts targeting messaging platforms.