taldvrof[.]sbs

Analysis of the domain taldvrof.sbs indicates it is an active phishing infrastructure targeting users through a Messenger-themed lure. The domain was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 27.124.47.186, hosted by Rackip Consultancy Pte. LTD in Hong Kong. The page title explicitly displays 'Messenger,' suggesting an attempt to impersonate the platform for credential harvesting or malware distribution. The SSL certificate, issued for 'Telegram / *.local,' does not align with the expected domain or brand, further signaling misrepresentation. As of July 19, 2026, the domain remains operational, returning an HTTP 200 status, and is flagged by 15 of 91 security vendors on VirusTotal. It is also blocked by PhishDestroy and appears on at least one security blocklist. Nameservers ns3.my-nds.com and ns4.my-nds.com are associated with the domain, though their historical use in similar campaigns is not confirmed in the available data. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS and network layers. Additional monitoring of related infrastructure, particularly IPs and nameservers linked to this registrar or hosting provider, is recommended to identify potential lateral movement or new domains in the same campaign. The exact phishing kit or payload remains unanalyzed, and no specific victim data or targeting patterns have been observed in the current evidence.