teleyxcn[.]sbs

The domain teleyxcn.sbs is currently active and serves a page titled “Messenger”. It resolves to the IPv4 address 27.124.47.186, which is geolocated to Hong Kong and is listed as belonging to Rackip Consultancy Pte. Ltd. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The site presents a valid HTTPS certificate that references “Telegram / *.local”, an incongruous detail that may be used to evade simple certificate checks. An HTTP GET returns a 200 status code, indicating the page is reachable and content is being served. The domain is already blocked by the PhishDestroy service and appears on one external blocklist. VirusTotal analysis shows that 15 of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion of phishing activity. Although the exact visual content of the page has not been examined, the combination of a Messenger‑related title, a mismatched TLS certificate, and the presence on multiple security feeds suggests the site is being used to lure victims into providing credentials for a messaging service. Defenders should add teleyxcn.sbs to URL filtering rules, block traffic to its IP address, and monitor DNS queries for the associated name servers. Continuous re‑evaluation is advised, as the threat actor may modify the payload or host additional phishing pages under the same infrastructure.