twoifoyd[.]sbs

Analysis of the domain twoifoyd.sbs, observed on July 20 2026, indicates active generic phishing infrastructure. The site resolves to IP 27.124.47.186, which is geolocated to Hong Kong and attributed to Rackip Consultancy Pte. Ltd. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED and the authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. The HTTP response returns status 200 and the page title reported is “Messenger”, while the presented TLS certificate is issued to “Telegram / *.local”. The domain is listed on one public blocklist and has been flagged by 14 of 91 VirusTotal scanners, confirming malicious intent. PhishDestroy has already blocked the domain, yet it remains active. The combination of a legitimate‑looking messenger title, a Telegram‑related certificate, and a Hong Kong‑based host suggests an attempt to lure victims into providing credentials or personal information. However, the exact content of the landing page has not been publicly disclosed, leaving the precise phishing vector unclear. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated nameservers, and consider adding the IP address to threat‑intel feeds. Ongoing observation of any changes to the certificate or page title is recommended.