teolhpbo[.]sbs

This domain teolhpbo.sbs was registered on 15 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. DNS resolution points to 216.150.1.1, an address owned by Amazon.com, Inc. (AS16509) located in the United States, indicating the site is hosted on AWS infrastructure. The TLS certificate is issued by Let’s Encrypt and is valid for the current year, a pattern frequently observed in short‑lived phishing deployments. The HTTP response code is 200 and the page title returned is “Loading…”, which provides no legitimate context and is typical of placeholder pages used in credential‑harvesting campaigns.

Gridinsoft’s trust scoring assigns a value of 0 out of 100, confirming the site is regarded as highly untrustworthy. VirusTotal analysis shows that 12 of 91 AV engines flag the domain, demonstrating that multiple security products have identified malicious behavior. The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least one external sinkhole has taken action against it. Nameservers ns3.my-ndns.com and ns4.my-ndns.com are in use, but no further information about their ownership is disclosed.

Evidence confirms the presence of generic phishing activity, but the exact payload, target brand, or credential‑collection mechanism has not been publicly disclosed. Consequently, defenders cannot determine the specific lure or victim profile beyond the generic classification. Operators should immediately block DNS resolution for teolhpbo.sbs and any traffic to its hosting IP 216.150.1.1, incorporate the domain into web‑filter and intrusion‑prevention signatures, and monitor for outbound connections that may indicate successful credential exfiltration. Continuous re‑scanning of the URL and periodic review of threat‑intel feeds are advised to capture any evolution of the campaign.