telegram-mini-app-9v1[.]pages[.]dev

telegram-mini-app-9v1.pages.dev is a confirmed phishing domain operating as a counterfeit Telegram mini-app designed to steal user credentials. The site is classified under the threat type 'generic_phishing' and is currently active as of the latest intelligence. There is no indication of brand impersonation beyond the Telegram mini-app theme, which is the focal point of the fraudulent activity.

This domain was flagged by 2 of 95 VirusTotal security vendors, indicating low but notable detection. It resolves to the IP address 188.114.97.3 and is registered through Cloudflare, Inc. The domain operates with a valid SSL certificate issued by Google Trust Services, which may contribute to its perceived legitimacy. While the exact creation date is undisclosed, the domain's infrastructure and hosting details suggest a recent deployment aimed at exploiting unsuspecting users.

Given the active status of this phishing site, users are strongly advised to avoid interacting with telegram-mini-app-9v1.pages.dev or any links associated with it. Security teams should implement network-level blocking for the IP address 188.114.97.3 and monitor for any related domains mimicking the Telegram mini-app branding. Additionally, users should verify the legitimacy of Telegram mini-apps by cross-referencing official sources and enabling multi-factor authentication to mitigate credential theft risks. Immediate reporting of this domain to relevant threat intelligence platforms is encouraged to aid in broader detection efforts.