telexszy[.]sbs

Analysis indicates that the domain telexszy.sbs is an active phishing site targeting users through a Messenger-themed interface. The domain was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. Infrastructure review shows nameservers ns3.my-nddns.com and ns4.my-nddns.com, which have been previously associated with phishing campaigns. The site returns an HTTP 200 status, suggesting active hosting, and presents a page titled 'Messenger,' though the exact content and functionality remain unconfirmed. Security vendors have flagged this domain, with 17 of 91 engines on VirusTotal detecting malicious activity. The domain appears on one security blocklist and has been referenced in two AlienVault OTX threat intelligence pulses. The SSL certificate is issued for Telegram and a wildcard *.local domain, which may indicate an attempt to appear legitimate or evade detection. Defenders should treat this domain as high-risk and prioritize blocking both the domain and its resolving IP. Given the lack of confirmed brand impersonation beyond the page title, organizations should monitor for credential harvesting or social engineering attempts linked to Messenger services. No evidence currently suggests a specific phishing kit or additional infrastructure, so further investigation into associated IPs or domains may be required to assess the full scope of this campaign.