teoscpll[.]sbs

This domain is flagged as a high-risk brand impersonation threat targeting Google. Registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, it remains active as of the analysis date. Infrastructure analysis reveals the domain resolves to IP address 216.150.1.1, hosted in the United States on AS16509 (Amazon.com, Inc.). The nameservers are ns3.my-ndns.com and ns4.my-ndns.com, and the SSL certificate is issued by Let's Encrypt (YR1). The HTTP status is 200, indicating the server is responsive. VirusTotal data shows 12 of 91 security vendors flagging this domain as malicious, and it appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0/100, corroborating the high-risk assessment. The page title is 'Loading...', which is consistent with phishing pages that delay content delivery to evade detection or redirect users after initial analysis. The exact content served to visitors has not been captured, but the combination of recent registration, low trust score, multi-vendor detection, and the brand target of Google strongly suggests this domain is part of a credential theft or account compromise campaign. Defenders should block access to this domain at the network level, monitor for similar domains registered through the same registrar or hosted on the same IP range, and review logs for any users who may have visited the site. Given the active status and high risk, immediate remediation actions are recommended.