teolsijx[.]sbs

Analysis indicates that the domain teolsijx.sbs is actively hosting a phishing site identified by the page title “Messenger”. The site resolves to the IPv4 address 27.124.47.186, which is geolocated to Hong Kong and is associated with Rackip Consultancy Pte. Ltd. The domain is delegated to the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. An SSL certificate presented by the server is issued to “Telegram / *.local”, suggesting an attempt to masquerade as the Telegram messenger service. HTTP requests to the host return a 200 OK status, confirming that the web service is reachable. The domain is listed on a single security blocklist and has been flagged by the PhishDestroy feed. VirusTotal analysis shows that 16 of 91 scanned security vendors classify the domain as malicious, reinforcing the suspicion of phishing activity. Current intelligence does not include a detailed snapshot of the page content, login forms, or credential‑stealing mechanisms, so the exact phishing workflow remains unverified. Defenders should block both the domain and its resolved IP address at perimeter firewalls and DNS resolvers, monitor for outbound connections to the host, and consider adding the domain to internal threat‑intel feeds. Continuous re‑evaluation is advised in case additional indicators, such as malware payloads or credential harvesting URLs, emerge.