telecocc[.]sbs

This domain, telecocc.sbs, is flagged as an active phishing site impersonating the Messenger platform to harvest user credentials. Analysis indicates the page title explicitly mimics the legitimate service, suggesting a targeted fake login campaign. No direct evidence of a crypto drainer kit or other payload was observed, but the domain’s infrastructure aligns with credential theft operations. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.68.124 and uses an SSL certificate issued by Google Trust Services. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious. AlienVault OTX lists it in one threat intelligence pulse, though no additional blocklist entries were identified at the time of analysis. Google Safe Browsing status was not explicitly confirmed. The domain remains active and poses an elevated risk to users. Immediate response actions include blocking the domain and IP at the network level, as well as alerting users to the threat via endpoint protection systems. Despite the low detection count on VirusTotal, the domain’s recent registration and brand impersonation tactics warrant continued monitoring. Organizations should prioritize user education on recognizing fake login pages and enforce multi-factor authentication to mitigate credential theft risks.