tcisywgb[.]sbs

Analysis indicates that the domain tcisywgb.sbs is actively serving HTTP content (status 200) with the page title “Messenger”. The site is hosted at IP 27.124.47.186, which resolves to a Hong Kong location operated by Rackip Consultancy Pte. LTD. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED and the authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. Security telemetry shows the domain is listed on one blocklist and has been flagged by PhishDestroy. It appears in two AlienVault OTX pulses and 14 of 91 VirusTotal scanners have reported it as malicious. The presented SSL certificate is issued to “Telegram / *.local”, which does not correspond to the domain name and may be used to obscure legitimate encryption. No further content analysis is available; the specific phishing lure or credential‑stealing page has not been observed. Defenders should add tcisywgb.sbs to deny‑list rules, enforce TLS inspection, and monitor outbound connections to the associated IP. Continuous threat‑intel feeds should be consulted for any emerging indicators, and users should be warned that any unsolicited request referencing “Messenger” from this domain may be hostile.