website-40d88156[.]sby[.]gzj[.]temporary[.]site

This domain, website-40d88156.sby.gzj.temporary.site, is actively impersonating Telekom as part of a credential phishing operation. Registered on August 4, 2023, through ENOM, INC., the domain resolves to the IP address 50.6.43.58 and is currently flagged by 16 out of 95 security vendors on VirusTotal. The page title explicitly displays 'Telekom Login,' confirming its intent to deceive users into entering login credentials under the guise of the legitimate telecommunications provider. Infrastructure analysis reveals that the domain is hosted with an SSL certificate issued by Sectigo Limited, which does not mitigate its malicious nature. It appears on two security blocklists, specifically PhishDestroy and PhishingDB, and maintains a trust score of 0/100, indicating high confidence in its classification as a phishing threat. The domain remains active as of July 12, 2026, with no signs of takedown or mitigation. While the exact content of the phishing page has not been analyzed, the combination of the page title, brand impersonation, and security vendor detections strongly suggests a targeted campaign aimed at harvesting Telekom credentials. The use of a temporary subdomain structure (sby.gzj.temporary.site) may indicate an effort to evade detection or facilitate rapid deployment of additional phishing infrastructure. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for any attempts to access it from internal systems. Given its presence on multiple blocklists and consistent vendor detections, this domain poses a high risk to users and organizations. Additional scrutiny of related IPs, certificates, or registration patterns may uncover further malicious infrastructure associated with this campaign.