telkom-logiin-page[.]weebly[.]com

This domain is flagged at an elevated risk level for hosting a credential phishing campaign specifically designed to impersonate Telkom login portals. Analysis indicates the site is engineered to harvest user credentials through fraudulent login interfaces, a common tactic in targeted phishing operations. The domain exhibits multiple technical indicators consistent with malicious infrastructure, warranting immediate attention from security teams and end-users. Infrastructure analysis reveals the following technical details: the domain resolves to IP address 74.115.51.8, hosted on AS27647 (Weebly, Inc.) in the United States. It is registered through Squarespace Domains II LLC and was created on February 21, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites. Detection metrics show 17 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one security blocklist. The page title 'Just a moment...' is consistent with evasion techniques used to delay or mislead automated analysis tools. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (74.115.51.8) at the network perimeter. Security teams should prioritize scanning for connections to this domain in proxy and DNS logs, particularly from endpoints within Telkom's user base. End-users should be alerted to verify the authenticity of any Telkom login portal by checking for the correct official domain and SSL certificate details. Multi-factor authentication (MFA) should be enforced for all Telkom-related accounts to mitigate the impact of credential theft. Given the future creation date, organizations should also review domain registration monitoring systems to detect similar spoofing attempts.