telexwsj[.]sbs

Analysis indicates that telexwsj.sbs is an active phishing domain targeting users through a Messenger-themed fraudulent page. Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. Nameservers ns3.my-ndns.com and ns4.my-ndns.com are associated with the infrastructure. The page title, 'Messenger,' suggests an attempt to impersonate a messaging service, though the exact content and targeted brand remain unconfirmed due to lack of deeper forensic analysis. Technical indicators reveal an HTTP 200 status, confirming the site is operational as of July 19, 2026. The SSL certificate, issued for 'Telegram' and a wildcard *.local domain, is inconsistent with the expected legitimate service, further supporting its fraudulent nature. Sixteen of 91 security vendors on VirusTotal have flagged the domain, and it appears in two AlienVault OTX threat intelligence pulses, alongside one security blocklist. PhishDestroy has also blocked the domain. Defenders should treat telexwsj.sbs as high-risk and prioritize blocking or monitoring traffic to this domain. The use of generic nameservers and hosting in a region frequently associated with malicious activity warrants heightened scrutiny. Additional investigation into connected infrastructure, such as shared IPs or domains under the same nameservers, is recommended to identify related threats.