twoizsjv[.]sbs

Analysis indicates that the domain twoizsjv.sbs is actively engaged in phishing operations targeting users of Messenger, as evidenced by its page title and infrastructure characteristics. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD. Security vendors have flagged this domain, with 16 of 91 engines on VirusTotal identifying it as malicious. The domain's nameservers, ns3.my-nddns.com and ns4.my-nddns.com, are consistent with infrastructure observed in other phishing campaigns, though no specific phishing kit or brand impersonation beyond the 'Messenger' page title has been confirmed. The SSL certificate is issued for 'Telegram' and a wildcard *.local domain, which is atypical for legitimate services and suggests an attempt to obfuscate the site's true purpose or evade detection. Defenders should note that the domain remains active, returning an HTTP 200 status, and is currently blocked by at least one security provider, PhishDestroy. The combination of a high-risk hosting location, suspicious SSL certificate, and detection by multiple security engines warrants immediate blocking at the network level. While the exact phishing mechanics are not yet analyzed, the presence of the 'Messenger' title indicates an intent to deceive users into divulging credentials or other sensitive information. Organizations are advised to monitor for connections to 27.124.47.186 and correlate with any reports of unauthorized access or credential theft linked to Messenger-themed lures.