telexbmk[.]sbs

This domain is currently under investigation for generic_phishing activity, specifically impersonating a Messenger service to deceive users. The infrastructure analysis reveals a low-detection profile, which may indicate early-stage malicious deployment or evasion techniques designed to avoid automated scrutiny. Analysis indicates the domain telexbmk.sbs was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 27.124.47.186, which has not been widely flagged in threat intelligence feeds. VirusTotal reports 0 out of 95 detections, suggesting the domain has not yet been identified by major security vendors. The SSL certificate is issued under the name Telegram, further attempting to lend legitimacy to the impersonation scheme. No blocklist entries or adverse trust scores were identified at the time of assessment, though the domain remains active and operational. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address at the network perimeter. Organizations should monitor for any SSL certificates issued under Telegram or Messenger-related names that do not originate from official sources. End-user education should emphasize verifying domain authenticity before entering credentials, particularly for communication platforms. Security teams are advised to inspect web traffic logs for connections to 27.124.47.186 or requests to telexbmk.sbs, as these may indicate compromised endpoints or targeted phishing attempts. Proactive hunting for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED may uncover additional threats in the same campaign.