telemncp[.]sbs

This domain, telemncp.sbs, is identified as a high-risk phishing site specifically designed to impersonate the Messenger platform. Analysis of the page title, which explicitly displays 'Messenger,' indicates an intent to deceive users into submitting login credentials or other sensitive information through a fraudulent interface. No direct evidence of a drainer kit was observed, but the domain’s infrastructure aligns with credential-harvesting campaigns targeting social media and communication platforms. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 172.67.192.246 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 25, 2026. Detection metrics show that 3 out of 95 security vendors on VirusTotal have flagged the domain as malicious. Additionally, the domain appears in one AlienVault OTX threat intelligence pulse and is listed on a single security blocklist. At the time of analysis, the domain remains unlisted on Google Safe Browsing (GSB), which may contribute to its continued effectiveness in evading automated detection systems. As of the latest assessment, telemncp.sbs remains active, posing an ongoing risk to users who may encounter it through phishing links distributed via email, social media, or malicious advertisements. Immediate response actions are recommended, including the addition of the domain to internal blocklists, dissemination of indicators of compromise (IOCs) to relevant security teams, and user education on recognizing phishing attempts. Despite partial detection by security vendors, the domain’s low blocklist prevalence and absence from GSB underscore the need for heightened vigilance and proactive monitoring to mitigate credential theft and account compromise risks.