telkompass[.]weebly[.]com

The domain telkompass.weebly.com is confirmed as an active credential theft site impersonating Telkom Indonesia, a major telecommunications provider. Analysis indicates the page is designed to harvest user login credentials through deceptive login portals mimicking legitimate Telkom services. The domain remains operational as of this report, with no takedown actions observed. Infrastructure analysis reveals the domain resolves to the IP address 74.115.51.8, hosted under AS27647 (Weebly, Inc.) in the United States. The domain was registered through Squarespace Domains II LLC on February 21, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. Detection metrics show the domain is flagged by 18 of 95 security vendors on VirusTotal, with one additional security blocklist listing it as malicious. The SSL certificate is issued by Let's Encrypt (serial number E8), a common tactic to lend false legitimacy to phishing infrastructure. Current status indicates the site remains accessible, posing an elevated risk to users. Recommendations include immediate blocking of the domain and IP at the network level, deployment of endpoint detection rules to prevent access, and user education on recognizing credential theft tactics. Organizations should monitor for unauthorized access attempts linked to credentials harvested from this domain. No legitimate business or service is associated with this infrastructure.