tcodtkpw[.]sbs

This domain, tcodtkpw.sbs, is actively engaged in a brand impersonation phishing scheme targeting users of the Messenger platform. Analysis indicates the site mimics Telegram’s login interface, as evidenced by its page title 'Messenger' and SSL certificate claiming affiliation with Telegram. The objective is to deceive visitors into entering legitimate credentials, which are then harvested by threat actors for unauthorized account access, financial fraud, or further phishing campaigns. The site poses a significant risk to users who may unknowingly disclose sensitive authentication details, leading to potential account takeovers or identity theft. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It currently resolves to the IP address 27.124.47.186, and VirusTotal reports that 12 out of 95 security vendors flag tcodtkpw.sbs as malicious. The SSL certificate, while falsely claiming to be issued for Telegram, further underscores the attempt to lend credibility to the fraudulent site. The domain remains active, increasing the likelihood of continued victimization. Users who have visited tcodtkpw.sbs or entered credentials on the site should take immediate action to mitigate potential harm. First, reset passwords for any accounts accessed through the site, prioritizing those linked to financial services or sensitive data. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the respective platform’s support team. Additionally, scan local devices for malware, as phishing sites may deploy malicious payloads. If financial information was entered, contact relevant institutions to secure accounts and consider placing a fraud alert on credit reports. Awareness of such threats and proactive security measures are essential to minimizing risk.