telchmfn[.]sbs

This domain, telchmfn.sbs, is flagged as an active high-risk phishing infrastructure specifically designed to harvest Messenger user credentials. Analysis indicates the threat type is credential phishing, targeting users through fraudulent login interfaces mimicking legitimate messaging platforms. The domain's page title, 'Messenger,' further supports the intent to deceive users into believing they are interacting with an authentic service. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on June 14, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 27.124.47.186, which has been linked to prior phishing campaigns. Security vendor detection on VirusTotal stands at 12 out of 95 engines, indicating moderate but concerning consensus on its malicious nature. The SSL certificate is issued under the name 'Telegram,' a tactic used to lend false legitimacy to the phishing site. No reputable blocklists or trust scores currently list the domain as benign, reinforcing its classification as a high-risk entity. Mitigation against this specific threat requires a multi-layered approach. Users should avoid interacting with telchmfn.sbs and any associated links, particularly those delivered via unsolicited messages or emails. Network-level protections, such as DNS filtering or IP-based blocking of 27.124.47.186, can prevent access to the domain. Organizations should update endpoint detection rules to flag domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED with recent creation dates, as these are common attributes of phishing infrastructure. Additionally, users who may have entered credentials on the site should immediately reset passwords and enable multi-factor authentication on their accounts to mitigate potential compromise.