tesiahlnh[.]sbs

Analysis indicates that the domain tesiahlnh.sbs is actively serving a high-risk phishing campaign targeting users of a messaging platform. As of July 19, 2026, the domain remains operational, resolving to IP address 27.124.47.186, which is geolocated in Hong Kong and associated with Rackip Consultancy Pte. LTD. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses nameservers ns3.my-ndns.com and ns4.my-ndns.com, infrastructure commonly observed in phishing operations. The page title 'Messenger' suggests an attempt to impersonate a legitimate messaging service, though the exact visual or functional mimicry has not been confirmed. Security vendors have detected malicious activity: 17 of 91 engines on VirusTotal flag the domain as harmful. The domain appears on one security blocklist and has been referenced in two threat intelligence pulses on AlienVault OTX, indicating prior recognition by the security community. The site returns an HTTP 200 status, confirming active hosting, and presents an SSL certificate issued for Telegram or a wildcard *.local domain, which may be used to lend false legitimacy to the phishing page. Defenders should treat tesiahlnh.sbs as a confirmed phishing domain. Network-level blocking of the IP 27.124.47.186 and the domain itself is recommended. Organizations using threat intelligence feeds should prioritize monitoring for connections to this infrastructure, particularly in environments where messaging services are in use. Further investigation into the registration pattern and nameserver reuse may reveal additional related domains.