teletnko[.]sbs

This domain, teletnko.sbs, is flagged as a generic phishing site impersonating Telegram, a widely used messaging platform. Analysis indicates the infrastructure is designed to harvest user login credentials through deceptive login portals, as suggested by the SSL certificate labeled 'Telegram' and the observed page title 'Loading...'. No direct association with known drainer kits or cryptocurrency theft scripts has been confirmed, though the credential harvesting intent aligns with broader phishing objectives. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 216.150.1.1 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 14, 2026. Detection metrics include a VirusTotal score of 16/95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Google Safe Browsing (GSB) status was not explicitly provided, but the offline status suggests mitigation efforts may be underway. As of the latest assessment, teletnko.sbs has been taken offline, reducing immediate exposure risk. However, the domain's recent creation date and the use of a registrar known for lenient enforcement policies indicate potential for re-emergence under similar infrastructure. Users who may have interacted with this domain are advised to reset credentials for any accounts accessed during the exposure window, particularly those associated with Telegram. Organizations should monitor for related domains registered through the same registrar or resolving to the identified IP address, as these may represent secondary or backup phishing infrastructure.