telckqfk[.]sbs

This domain, telckqfk.sbs, is flagged as an active high-risk phishing site impersonating a Messenger service, as indicated by its page title 'Messenger' and confirmed infrastructure anomalies. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD. Analysis reveals suspicious nameservers (ns3.my-nds.com, ns4.my-nds.com) and an SSL certificate issued for 'Telegram' or '*.local', which does not align with the expected branding for a legitimate Messenger platform. The domain appears in two AlienVault OTX threat intelligence pulses and is blocked by PhishDestroy, with 17 of 91 security vendors on VirusTotal flagging it as malicious. While the exact phishing kit or payload remains unconfirmed, the combination of misaligned SSL certificates, unusual nameservers, and geographic hosting in a known high-risk region strongly suggests malicious intent. Defenders should treat this domain as compromised, block it at the DNS and proxy levels, and monitor for related indicators of compromise, including the associated IP and nameserver infrastructure. The site remains active as of July 19, 2026, and further analysis of its content is recommended to determine the specific phishing mechanics employed.