twoilprn[.]sbs

This domain, twoilprn.sbs, presents a high risk due to its use in credential theft operations. The site masquerades as a Messenger login page, aiming to harvest user credentials under false pretenses. The threat is considered active and ongoing, with infrastructure supporting impersonation tactics targeting end-users.

Technical analysis confirms the following: twoilprn.sbs was registered on June 15, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to IP address 27.124.47.186. VirusTotal analysis shows 12 out of 95 security vendors have flagged this domain as malicious. AlienVault OTX lists it in at least one threat intelligence pulse. The page title returned is 'Messenger,' which suggests brand impersonation to facilitate unauthorized credential collection.

To mitigate risk, users and organizations should immediately block access to twoilprn.sbs at the network and endpoint levels. Security teams should review authentication logs for suspicious activity related to Messenger accounts and deploy anti-impersonation controls. Users should be reminded to verify URLs and avoid entering credentials on unfamiliar or unsolicited login pages.