telemgti[.]sbs

The domain telemgti.sbs has been identified as a credential theft scam, designed to harvest user login credentials through deceptive login portals. As of the latest analysis, the domain is currently offline, though prior activity suggests it was actively targeting unsuspecting users. No specific brand impersonation has been confirmed, but the infrastructure aligns with known credential harvesting campaigns. Infrastructure analysis reveals that telemgti.sbs was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolved to the IP address 216.150.1.1, which has been linked to other malicious activities in recent threat intelligence reports. Detection metrics indicate that 7 of 95 security vendors on VirusTotal flagged the domain as malicious, while it also appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (YR2), is commonly used in both legitimate and malicious domains, providing no inherent trust indicators. The page title, 'Loading...,' suggests an attempt to mimic legitimate loading screens to delay user suspicion. Given the domain's current offline status, immediate interaction risks are mitigated; however, users should remain cautious of potential re-emergence or similar domains. Organizations and individuals are advised to block the domain and its associated IP (216.150.1.1) at the network level. End-users should verify website authenticity before entering credentials and enable multi-factor authentication on critical accounts. Security teams are encouraged to monitor for related infrastructure, including domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and IP ranges associated with 216.150.1.1.