tellldn[.]sbs

Analysis of the domain tellldn.sbs shows that it was registered on 17 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active with an HTTP 200 response. The site presents a generic page titled “Loading…”, which is consistent with a fast‑deployment phishing front‑end. The domain is listed as an impersonation phishing campaign and has been added to the PhishDestroy blocklist. Infrastructure analysis reveals that the domain resolves to the IP address 216.150.1.1, which belongs to Vercel, Inc. The hosting provider is confirmed by the presence of Vercel in the technology fingerprint, and HTTP Strict Transport Security (HSTS) is enforced. The TLS certificate is issued by Let’s Encrypt, short‑lived (YR1), indicating a recent deployment. No additional services or sub‑domains are disclosed. Threat indicators include a Gridinsoft trust score of 0 out of 100 and placement on one security blocklist. VirusTotal reports that four of ninety‑five scanning engines flag the domain as malicious, reinforcing the suspicion of phishing activity. The low trust score and blocklist inclusion suggest that the site is being used to harvest credentials, although the exact payload or targeted brand has not been observed in the publicly visible page. Defenders should add the IP address 216.150.1.1 and the domain tellldn.sbs to outbound and inbound filtering rules, enforce DNS sinkholing, and monitor TLS certificate changes. Continuous scanning of the domain for content changes is advised, as the minimal page may later be populated with credential‑capture forms. Coordination with blocklist providers such as PhishDestroy can ensure timely updates to security controls.