telgqxtt[.]sbs

This domain, telgqxtt.sbs, is identified as a fraudulent phishing site specifically targeting users of the Telegram messaging platform. Analysis indicates the site was designed to impersonate official Telegram services, likely to harvest user credentials, personal data, or distribute malicious payloads under the guise of legitimate communication. The domain is currently offline, but prior activity confirms its role in generic phishing operations with a focus on brand exploitation. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to the IP address 216.150.1.1 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 14, 2026. It holds a Gridinsoft trust score of 0 out of 100, and VirusTotal reports that 10 of 95 security vendors flag the domain as malicious. The SSL certificate is falsely issued under the name Telegram, further attempting to deceive users into trusting the site. Additionally, the domain appears on one security blocklist, and its page title, 'Loading...', suggests an attempt to evade detection or delay content rendering for malicious purposes. The domain has been taken offline, reducing immediate risk to users. However, the infrastructure and registration patterns observed warrant continued monitoring. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and scan systems for potential malware. Security teams should review logs for connections to 216.150.1.1 or attempts to access telgqxtt.sbs, as these may indicate compromise or targeted phishing attempts.