tekstnbp[.]sbs

The domain tekstnbp.sbs is currently active and serves a page titled “Messenger” over HTTP 200. DNS resolution points to IP 27.124.47.186, which GeoIP locates to Hong Kong and is associated with Rackip Consultancy Pte. Ltd. The domain is registered via NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the nameservers ns3.my-ndns.com and ns4.my-ndns.com. An SSL certificate issued to “Telegram / *.local” is presented, which does not match the domain name and may indicate mis‑configuration or an attempt to leverage trust in a known service. The site has been flagged by PhishDestroy and appears on one external blocklist. VirusTotal analysis shows eight of ninety‑one security vendors flag the domain as malicious, reinforcing the suspicion of phishing activity. Defenders should immediately block tek​stnbp.sbs and its resolved IP address at perimeter firewalls and DNS filters. Continuous monitoring of traffic to the associated nameservers and the Hong Kong IP is advised to detect any pivoting attempts. Since the page title suggests a messenger‑related credential harvest, organizations should alert users to verify any unsolicited messenger login prompts and enforce multi‑factor authentication for messaging accounts. Incident response teams should capture HTTP headers, TLS handshake data, and any redirected URLs for deeper forensic analysis, as the current evidence does not disclose the exact payload or credential‑stealing mechanisms employed.