teksnjrq[.]sbs

This domain is flagged as a high-risk credential theft operation targeting users of the Messenger platform. Analysis indicates the infrastructure is designed to harvest login credentials through brand impersonation, leveraging a deceptive page title labeled 'Messenger' to trick victims into entering sensitive information. Infrastructure analysis reveals the domain teksnjrq.sbs was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 27.124.47.186 and employs an SSL certificate falsely labeled 'Telegram,' likely to enhance perceived legitimacy. Security vendor detections on VirusTotal stand at 14 out of 95, while AlienVault OTX lists the domain in one threat intelligence pulse, confirming its malicious classification. The domain remains active as of this report, with no signs of takedown or remediation. Mitigation against this credential theft threat requires immediate action. Network defenders should block the domain teksnjrq.sbs and its associated IP 27.124.47.186 at perimeter security controls. End users should be educated to verify domain authenticity before entering credentials, particularly for platforms like Messenger. Organizations are advised to monitor for unusual authentication attempts originating from this infrastructure, as compromised credentials may be exploited for follow-on attacks such as account takeovers or lateral movement within networks.