twoimjgq[.]sbs

This domain is flagged as a high-risk phishing site specifically designed to impersonate Messenger login portals. Analysis indicates the threat type involves credential harvesting through fake authentication pages, likely targeting users of the popular messaging platform to steal account credentials and session tokens. The infrastructure exhibits multiple red flags consistent with organized phishing campaigns, including recent domain registration and association with known malicious hosting providers. Infrastructure analysis reveals the domain twoimjgq.sbs was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive domains. The domain resolves to IP address 27.124.47.186 and currently maintains a Gridinsoft trust score of 0/100. Security vendors on VirusTotal flag this domain at a rate of 19/95, while it appears on three distinct security blocklists including PhishDestroy, PhishingArmy, and Hagezi. AlienVault OTX records the domain in one threat intelligence pulse, confirming its malicious classification. The page title 'Messenger' directly indicates the targeted brand impersonation. Mitigation requires immediate action from network security teams and end users. Organizations should implement DNS-based blocking for twoimjgq.sbs and its resolving IP 27.124.47.186 across all security gateways. Endpoint protection systems should be updated to include this domain in phishing detection rules, with particular attention to Messenger-related URL patterns. Users who may have interacted with this domain should immediately reset their Messenger credentials from a verified device and enable multi-factor authentication. Security teams should monitor for successful authentications from the resolving IP address and investigate any associated account activity for signs of compromise.