teledoud[.]sbs

This domain is flagged as a high-risk phishing site specifically designed to impersonate the Messenger platform. Analysis indicates it functions as a fake login page, likely harvesting user credentials through deceptive authentication prompts. The infrastructure exhibits multiple red flags consistent with credential theft operations, including the use of a misleading page title and SSL certificate spoofing. Infrastructure analysis reveals the domain teledoud.sbs resolves to the IP address 27.124.47.186 and was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The SSL certificate is falsely labeled as 'Telegram,' attempting to lend credibility to the fraudulent site. VirusTotal detection rates show 12 out of 95 security vendors flagging the domain as malicious, with no observed trust scores or blocklist entries beyond these detections. The domain remains active as of the latest verification, indicating ongoing operational status. Mitigation against this threat involves immediate blocking of the domain and associated IP address within network security controls. Users should be advised to verify the authenticity of any Messenger login page by checking the URL for official branding and HTTPS certificate details. Organizations should monitor for credential reuse attempts stemming from harvested accounts and implement multi-factor authentication to mitigate the impact of potential credential theft. Security teams are recommended to review logs for connections to 27.124.47.186 and alert on any interaction with the domain.