talddgod[.]sbs

Analysis of talddgod.sbs on 19 July 2026 indicates an active generic phishing infrastructure targeting messenger services. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv4 address 27.124.47.186, which is associated with a Rackip Consultancy Pte. LTD facility in Hong Kong. HTTP requests return status 200, and the TLS certificate presented is issued to “Telegram / *.local”, suggesting possible misuse of a legitimate brand’s certificate. Authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. The page title returned is “Messenger”, but the site content has not been examined. Detection metrics show that 14 of 91 VirusTotal security vendors have flagged the domain, and it appears on one external blocklist. PhishDestroy has already blocked the domain. While the exact phishing kit or victim lure remains unknown, the evidence confirms the domain is operational and likely used to harvest credentials. Defenders should add the domain to outbound‑traffic blocklists, enforce TLS inspection to capture credential submissions, monitor DNS queries for talddgod.sbs, and consider sinkholing the associated IP range. Ongoing observation is recommended to capture any changes in hosting or URL paths.