tewjavv[.]sbs

tewjavv.sbs is identified as a confirmed phishing site, actively engaging in malicious activities targeting users, particularly those associated with Telegram. The domain was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, which is often noted for hosting low-reputation domains. Current analysis shows that the site resolves to the IP address 216.150.1.1, contributing to its active status and presence in multiple threat intelligence feeds.

The domain has been captured in 14 threat intelligence pulses on AlienVault OTX, suggesting that it has been recognized for phishing attempts on multiple occasions. VirusTotal scanning reveals that 15 out of 95 security vendors flag this domain, indicating a significant recognition of its malicious intent. Furthermore, it has already been blocked by known cybersecurity services PhishDestroy and BLP-Malware, reinforcing its designation as a high-risk threat. Notably, it holds a Trust Score of 0 from Gridinsoft, suggesting it has a poor reputation among security analysts.

Additionally, tewjavv.sbs appears on at least two separate security blocklists, further corroborating its malicious profile. The page title, 'Loading...', offers no content to assess its specific intention but aligns with typical phishing tactics to deceive users into providing sensitive information. Defenders should prioritize blocking this domain across their networks and monitor for any communications that may lead users to it. Organizations should also educate their users about the risks associated with unsolicited requests for information, especially via platforms like Telegram. No definitive information has emerged about the precise modus operandi employed by this domain, highlighting the need for ongoing vigilance.