telgpfn[.]sbs

This domain, telgpfn.sbs, was registered on June 17, 2026, and is currently flagged as an active high-risk phishing infrastructure. Analysis indicates the domain resolves to 216.150.1.1, hosted on infrastructure associated with Vercel, Inc. in the United States. The site presents an HTTP 200 status with a blank page titled 'Loading...', a common tactic to evade initial detection while awaiting dynamic content injection or redirection to a malicious payload. The SSL certificate is issued by Let's Encrypt, a legitimate provider frequently abused for phishing due to its low-cost and automated issuance process. Infrastructure analysis reveals the use of Vercel, a platform often leveraged for rapid deployment of phishing pages due to its ease of use and free hosting tiers. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar historically linked to abusive registrations. While only one security blocklist currently lists this domain, four out of ninety-five security vendors on VirusTotal have flagged it as malicious, suggesting emerging detection but not yet widespread coverage. The Gridinsoft trust score of 0/100 further corroborates the domain's high-risk classification. Defenders should treat this domain as an active threat, particularly for credential harvesting or malware distribution. The combination of a recently registered domain, blank landing page, and Vercel hosting is consistent with phishing campaigns that deploy malicious content post-initial detection evasion. Network-level blocking of 216.150.1.1 and monitoring for outbound connections to telgpfn.sbs are recommended. Given the domain's young age and limited detection coverage, retrospective analysis of logs for prior connections to this domain is advised to identify potential prior compromise. No specific brand impersonation or phishing kit has been confirmed, but the domain's structure and hosting pattern align with generic credential theft operations.