teleblzr[.]sbs

This domain, teleblzr.sbs, is actively engaged in credential theft targeting users of the Messenger platform. Analysis of the page title, 'Messenger,' indicates an attempt to impersonate the legitimate messaging service to deceive users into entering their login credentials. The domain is designed to harvest sensitive information, including usernames, passwords, and potentially multi-factor authentication codes, which can lead to unauthorized account access, identity theft, or further malicious activities such as social engineering attacks or financial fraud. Evidence supporting the malicious nature of teleblzr.sbs includes detection by 15 out of 95 security vendors on VirusTotal, categorizing it as a phishing threat. The domain was registered on June 14, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 27.124.47.186, which has been linked to other suspicious activities. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX, further confirming its association with malicious campaigns. Users who have visited teleblzr.sbs or entered credentials on any page hosted by this domain should take immediate action. First, reset passwords for any accounts accessed or entered on the site, prioritizing Messenger and any accounts where the same credentials may have been reused. Enable multi-factor authentication on all critical accounts to mitigate the risk of unauthorized access. Monitor financial and communication accounts for signs of compromise, such as unauthorized logins or messages sent from the account. If personal or financial information was disclosed, consider reporting the incident to relevant authorities and credit monitoring services. Finally, ensure endpoint security tools are updated to detect and block access to this domain and related infrastructure.