teleqgyp[.]sbs

The domain teleqgyp.sbs was registered on 17 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IPv4 address 216.150.1.1. The IP is geolocated to the United States and is hosted on an infrastructure identified as Vercel. The site returns HTTP 200 and presents a TLS certificate issued by a public certificate authority, with HSTS enabled. The page title observed is a generic placeholder “Loading…”, indicating that the content is likely generated dynamically.

Reputation metrics place the domain at the lowest possible trust level, with a Gridinsoft score of 0 out of 100. VirusTotal analysis shows that 4 of 95 scanned security vendors flag the domain as malicious, confirming a high‑risk classification. The domain appears on a single external blocklist and has been specifically listed by PhishDestroy, reinforcing the assessment of a targeted phishing operation.

At present, visible indicators are limited to the infrastructure and reputation data; the actual payload, credential‑harvesting forms, or lure vectors remain unseen because the page renders only a loading placeholder. No additional malware hashes, command‑and‑control endpoints, or secondary domains have been disclosed. Consequently, the full scope of the campaign, including target audience and attack timeline, cannot be precisely determined.

Defenders should immediately block teleqgyp.sbs at DNS and proxy layers, and add the associated IP address 216.150.1.1 to network‑level deny lists. Continuous monitoring of outbound traffic for connections to the Vercel‑hosted IP is advised, as is periodic re‑evaluation of VirusTotal and other threat‑intel feeds for any new vendor detections. Logging of TLS handshakes and HTTP requests to this domain will aid future attribution and remediation.