teloxlot[.]sbs

Analysis indicates that teloxlot.sbs is an active phishing domain targeting users through a deceptive 'Messenger' interface. Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 27.124.47.186, hosted under Rackip Consultancy Pte. LTD in Hong Kong. Infrastructure review shows nameservers ns3.my-nds.com and ns4.my-nds.com, and an SSL certificate issued for 'Telegram' or a wildcard *.local domain, suggesting an attempt to mimic legitimate messaging platforms. The page title 'Messenger' further supports the likelihood of credential harvesting targeting social media or communication service users. As of July 20, 2026, the domain remains active, returning an HTTP 200 status, and is blocked by at least one security vendor (PhishDestroy). Five out of 91 security engines on VirusTotal flag the domain as malicious. While the exact phishing kit or targeted brand is not confirmed in available data, the combination of infrastructure, SSL certificate details, and page title strongly indicates a fraudulent login portal. Defenders should treat teloxlot.sbs as high-risk and prioritize blocking or monitoring connections to this domain. Further investigation into associated IP ranges and certificate issuance patterns may reveal additional linked infrastructure.