accounts[.]login[.]idm[.]telekom[.]com[.]metropoleweb[.]com

PhishDestroy identifies accounts.login.idm.telekom.com.metropoleweb.com as a high-risk credential phishing domain posing as the official Telekom login portal. This domain employs spoofing tactics to deceive users into surrendering sensitive login credentials by replicating the legitimate Telekom authentication interface.

This domain was flagged by 15 out of 95 VirusTotal security vendors and resolves to IP address 162.240.144.202. Registered through ENOM, INC. in July 2007, the domain also utilizes a Let's Encrypt SSL certificate to enhance its facade of legitimacy. Despite its age, the domain remains active and is associated with phishing campaigns targeting Telekom customers.

To mitigate risk, users must avoid interacting with this domain entirely. Telekom customers should verify the official domain (telekom.com) via their browser bookmarks or by manually typing the URL. If credentials were entered, change passwords immediately and enable multi-factor authentication where possible. Report suspicious domains to Telekom's security team and local cybercrime units to help disrupt ongoing phishing operations.