telexpnb[.]sbs

Analysis of the domain telexpnb.sbs, reported on July 19, 2026, shows an active generic phishing infrastructure. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and continues to resolve to the IPv4 address 27.124.47.186, which is associated with a Hong Kong hosting provider identified as Rackip Consultancy Pte. LTD. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. An SSL certificate issued to “Telegram / *.local” is presented, while the HTTP response returns status code 200 and a page title of “Messenger”. Threat intelligence indicates the domain appears on one security blocklist and is listed in two AlienVault OTX pulses. VirusTotal scans report 16 detections out of 91 vendors, and the domain is actively blocked by PhishDestroy. The limited public exposure prevents a full content analysis; the exact phishing lure and credential collection mechanisms remain unknown. Defenders should add the domain and its resolving IP to outbound and inbound deny lists, monitor DNS queries for the associated name servers, and enforce TLS inspection to capture any encrypted traffic. Continuous threat feed updates are advised to capture any new indicators that may emerge from this infrastructure.