telegram-auth[.]online

This domain, telegram-auth.online, is designed to deceive users into disclosing Telegram account credentials through a fraudulent authentication interface. Analysis indicates the site mimics legitimate Telegram login pages, likely harvesting entered usernames, passwords, and two-factor authentication codes. The threat primarily targets users seeking account verification or recovery, exploiting trust in the Telegram brand to facilitate unauthorized access to private communications and sensitive data. Infrastructure analysis reveals the domain was registered on May 28, 2026, through REG.RU LLC, an unusual future date suggesting potential domain spoofing or registry manipulation. At the time of detection, 7 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on 3 distinct security blocklists. The domain resolves to the IPv6 address 2a00:f940:2:2:1:1:0:257 and uses an SSL certificate issued specifically for telegram-auth.online, a common tactic to appear legitimate. The page title, 'Почти готово! Домен успешно привязан к хостингу,' indicates the site was either hastily deployed or in a transitional state when identified. Users who visited telegram-auth.online or entered credentials should immediately revoke any active Telegram sessions and change their account password. Enable two-factor authentication using an authenticator app, not SMS, to prevent SIM-swapping attacks. Monitor linked email accounts for unauthorized access attempts and review Telegram’s active sessions for unfamiliar devices or locations. If financial or personal data was exposed, consider placing a fraud alert on credit files. The domain has since been taken offline, but similar threats may emerge using comparable naming conventions or infrastructure.