teloakvm[.]sbs

Analysis of teloakvm.sbs indicates an active phishing domain targeting users of a messaging platform, as suggested by the page title 'Messenger'. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. Infrastructure analysis reveals the use of nameservers ns3.my-ndns.com and ns4.my-ndns.com, a configuration commonly observed in phishing campaigns. The domain is flagged by 16 of 91 security vendors on VirusTotal and appears in two AlienVault OTX threat intelligence pulses, confirming its malicious classification. It is also blocked by PhishDestroy and listed on one additional security blocklist. The SSL certificate is issued for 'Telegram' and a wildcard *.local domain, which does not align with the expected legitimate certificate for a messaging service, further indicating potential impersonation. The site remains operational, returning an HTTP 200 status, suggesting it is actively serving content. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS, IP, and endpoint levels. Additional monitoring of associated infrastructure, particularly the nameservers and hosting provider, is recommended to identify related threats. The exact phishing kit or payload is not yet analyzed, but the domain’s configuration and detection history warrant immediate mitigation.