telkomservicenet[.]weebly[.]com

The domain telkomservicenet.weebly.com was identified as a phishing infrastructure impersonating Telkom, a telecommunications provider. Analysis indicates this site operated as a fake login portal designed to harvest user credentials under the guise of the legitimate Telkom brand. The domain is currently offline, though prior activity suggests it was actively targeting users seeking Telkom account services or support. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating moderate to high detection confidence. It was registered through Safenames Ltd. and resolved to the IP address 74.115.51.8, hosted on AS27647 (Weebly, Inc.) in the United States. The domain was created on February 27, 2026, an anomalous future date that may indicate domain spoofing or registry manipulation. A single security blocklist, PhishDestroy, had previously listed the domain, while its SSL certificate was issued by Let's Encrypt (serial number E8). The page title, 'Telkomsa,' directly mirrors the branding of the legitimate Telkom South Africa service, reinforcing its impersonation intent. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to monitor network logs for connections to 74.115.51.8 or references to the domain in proxy data. Users who accessed the site should reset credentials for Telkom accounts and any reused passwords. Security teams should update blocklists to include the domain and IP, while verifying SSL certificate transparency logs for additional malicious issuances tied to the same infrastructure. Future monitoring of Weebly-hosted subdomains under similar naming conventions is recommended due to the platform's recurring use in phishing campaigns.