jko[.]igs[.]mybluehost[.]me

On July 23, 2026, the domain jko.igs.mybluehost.me was identified as an active credential‑phishing site targeting Telekom users. The domain was originally registered on October 5, 2016 through Domain.com – Network Solutions, LLC, and it continues to resolve to the IPv4 address 50.6.34.50, which is allocated to AS31898 (Oracle Corporation) in Germany. The authoritative nameservers ns1.mybluehost.me and ns2.mybluehost.me confirm hosting on the MyBluehost platform. An SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 chain is present, indicating that the site serves content over HTTPS despite the certificate offering no extended validation. HTTP requests to the domain return a 302 status code, suggesting a redirection that may be used to forward victims to a credential‑capture endpoint.

The page title observed during analysis is “Telekom Login,” directly aligning with the declared brand target of Telekom, and the scam type is catalogued as credential phishing. Security‑vendor analysis shows a Gridinsoft trust score of 0 / 100, reflecting a highly malicious reputation. VirusTotal scans have recorded 16 detections out of 93 participating vendors, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. The MX record points to mail.jko.igs.mybluehost.me, which may be used for exfiltrating harvested credentials.

Given the combination of a low trust score, multiple vendor detections, active blocklist entries, and the explicit brand impersonation, the domain presents a high‑risk profile. Defenders should immediately block traffic to 50.6.34.50 and to the host name jko.igs.mybluehost.me at network perimeter and DNS layers. Continuous monitoring of outbound connections to the MyBluehost nameservers is advised, as is the inclusion of the domain in email filtering rules to prevent credential leakage via the configured mail server.