telemdhe[.]com

telemdhe.com was registered on June 13, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of July 12, 2026. The site responds with HTTP 200 and presents a page title of “Loading…”. Automated analysis by Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on at least one public blocklist. VirusTotal scans have triggered detections from ten of ninety‑five security vendors, indicating a consensus that the site is malicious.

Technical reconnaissance shows the domain resolves to the IP address 216.150.1.1, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com, both typical of dynamic DNS services. The site uses a valid Let’s Encrypt TLS certificate (YR1) that provides encryption but does not authenticate the underlying content.

The combination of a freshly registered domain, a generic “Loading…” landing page, and a low Gridinsoft trust score of 0/100 aligns with the observed pattern of generic phishing campaigns that harvest credentials by mimicking legitimate login portals. Although the specific brand being spoofed has not been disclosed, the social‑engineering flag and the presence of the domain on the PhishDestroy blocklist suggest that the site is being used to lure users into submitting personal data.

Defenders should block DNS resolution to 216.150.1.1 and add telemdhe.com to web‑filter deny lists. Email security gateways should be configured to quarantine messages containing this URL, and endpoint protection solutions should be updated to recognize the ten vendor detections reported by VirusTotal. Continuous monitoring of the associated name servers and any future certificate changes is advised to detect potential re‑hosting or re‑use of the infrastructure.