telgfmun[.]sbs

Analysis indicates that the domain telgfmun.sbs is actively hosting phishing infrastructure targeting users of a messaging platform, as evidenced by its page title 'Messenger' and its inclusion on at least one security blocklist. The domain resolves to the IP address 27.124.47.186, which is geolocated in Hong Kong and associated with the hosting provider Rackip Consultancy Pte. LTD. Registration details show the domain was provisioned through NICENIC INTERNATIONAL GROUP CO., LIMITED, with nameservers ns3.my-nds.com and ns4.my-nds.com. The SSL certificate is issued for 'Telegram' and a wildcard covering *.local, which does not match the domain name and may indicate misconfigured or spoofed encryption. At the time of this report, the domain returns an HTTP 200 status, confirming it is accessible and operational. It has been flagged in two AlienVault OTX threat intelligence pulses, suggesting prior detection in related campaigns. Sixteen of 91 security vendors on VirusTotal have classified this domain as malicious, though the absence of detection by the remaining vendors does not confirm safety. The domain is currently blocked by PhishDestroy and remains active as of July 19, 2026. Defenders are advised to treat this domain as high-risk phishing infrastructure. Network-level blocking of both the domain and its resolving IP (27.124.47.186) is recommended. Additional monitoring of associated nameservers (ns3.my-nds.com, ns4.my-nds.com) may help identify linked malicious domains. The exact content and targeting of the phishing page remain unconfirmed, but the page title suggests an attempt to impersonate a messaging service. No further brand-specific details or scam categorization beyond the page title are available at this time.