telupku[.]sbs

telupku.sbs was registered on 17 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and immediately points to the IP address 216.150.1.1, a Vercel, Inc. hosting node located in the United States. The site serves content over HTTPS using a Let’s Encrypt YR1 certificate and enforces HTTP Strict Transport Security. An HTTP GET returns status code 200, and the page title reported by crawlers is “Loading…”, a pattern commonly used by credential‑harvesting pages that later redirect victims to a forged login interface.

The domain is currently marked as active with a high risk rating. VirusTotal analysis shows that 4 of 95 security vendors have flagged the host, indicating early detection by a minority of scanners. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single public blocklist, PhishDestroy, which has already blocked it. The limited vendor consensus and low trust score suggest that the infrastructure is deliberately minimal and may be used to evade broader detection.

Open‑source intelligence does not reveal the specific brand or service that telupku.sbs pretends to represent. The only observable indicator is the generic “Loading…” title, which provides no direct clue about the targeted organization. Consequently, attribution of the phishing campaign to a particular victim demographic remains uncertain, and further dynamic analysis of the page content would be required to confirm the exact credential‑stealing vector.

Defenders should add 216.150.1.1 and the domain telupku.sbs to outbound and inbound filtering rules, monitor DNS queries for the host, and consider sinkholing the IP address if feasible. Users should be warned to verify TLS certificates and to avoid entering credentials on pages that display incomplete or placeholder titles. Continuous re‑scan of the domain through multiple VT vendors is recommended to capture any escalation in detection scores.