telkilh[.]sbs

This domain is flagged as a credential harvesting phishing site with an elevated risk level. Analysis indicates it is designed to mimic legitimate login portals to steal user credentials, likely targeting financial or communication services given its infrastructure and SSL certificate association. Infrastructure analysis reveals telkilh.sbs was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 14, 2026, and resolves to IP address 216.150.1.1. Security vendors on VirusTotal detect it at 13/95, while it appears on one security blocklist. The domain’s SSL certificate is issued under the name 'Telegram,' suggesting an attempt to impersonate the messaging platform or exploit its branding. Gridinsoft assigns it a trust score of 0/100, and it is currently blocked by at least one anti-phishing system. The page title 'Loading...' further indicates an attempt to evade detection or delay rendering malicious content. To mitigate risks associated with this credential harvesting phishing domain, organizations should immediately block the domain and its resolving IP (216.150.1.1) at the network perimeter. Endpoint protection systems should be updated to flag or quarantine any attempts to access telkilh.sbs. Security teams should monitor for credential reuse attempts, particularly if the domain was accessed prior to takedown. User awareness training should emphasize verifying SSL certificates and domain authenticity before entering credentials, especially for platforms like Telegram that are frequently impersonated. Logs from June 14, 2026, onward should be reviewed for any connections to this domain or its IP.