telqint[.]sbs

The domain telqint.sbs was registered on June 14, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 216.150.1.1, which is announced by AS16509 and is hosted in the United States on Amazon Web Services infrastructure. Authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com, and the site presents a valid Let’s Encrypt TLS certificate (YR1) that returns an HTTP 200 status. The page title retrieved from the live site is “Loading…”, indicating that the front‑end is likely a placeholder for a malicious payload.

Analysis of public threat intel shows that telqint.sbs is classified as a generic phishing site and is currently listed as high‑risk. The domain appears on one security blocklist, PhishDestroy, and has been flagged by 7 out of 95 VirusTotal scanners. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The combination of a recent creation date, use of a reputable certificate to appear trustworthy, and the presence of the site on a dedicated phishing blocklist suggests an active campaign aimed at credential harvesting.

Uncertainty remains regarding the specific phishing lure employed, as the site’s visible content is limited to a loading placeholder and no explicit target brand or credential collection form has been observed. The lack of additional public sightings or broader blocklist coverage means the full scope of the campaign’s distribution channels cannot be fully quantified at this time.

Defenders should block DNS resolution for telqint.sbs at the network perimeter and add the associated IP address 216.150.1.1 to any existing deny lists. Monitoring for outbound connections to the identified Amazon hosting subnet is advised, as is the deployment of URL filtering rules that deny HTTP and HTTPS requests to the domain. Continuous threat‑intel feeds should be consulted for any updates on additional indicators of compromise linked to this infrastructure.