teksglwm[.]sbs

This domain, teksglwm.sbs, is flagged as a generic_phishing threat currently under investigation. It presents a fraudulent Messenger login page designed to harvest user credentials. The domain leverages a Telegram-branded SSL certificate to lend false legitimacy, targeting individuals expecting legitimate Messenger communications. The risk level remains active, indicating ongoing potential for credential theft.

Analysis reveals the domain resolves to IP 27.124.47.186 and was created on June 15, 2026. VirusTotal shows 0 detections out of 95 scans, meaning it has not been widely flagged by security vendors at this time. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, a known provider for high-risk domains. The SSL certificate imitates Telegram, not Messenger, suggesting a cross-brand phishing tactic. No blocklist counts are available from the provided data, but the domain's creation date and lack of detections indicate recent setup.

If a user visited teksglwm.sbs and entered credentials, they should immediately change passwords for Messenger, Telegram, and any linked accounts. Enable multi-factor authentication on all platforms. Monitor accounts for unauthorized access and report the domain to security teams. Avoid reusing passwords and run a full antivirus scan on the device. The browser history should be cleared, and sensitive sessions revoked.