Phishing sites impersonating Telegram

PhishDestroy has recorded 1,170 phishing domains impersonating Telegram since 2025-07-09, 50 of them in the last 30 days. The most used registrars are NICENIC and Cloudflare; the most common TLDs are .com and .dev. The official Telegram domain is telegram.org: any other site asking for your login or wallet is not Telegram.

1,170
Domains, all time
50
Last 30 days
593
Online at last check
143
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 12026-07-27: 62026-07-28: 32026-07-29: 12026-07-30: 12026-07-31: 152026-08-01: 52026-08-02: 32026-08-03: 42026-08-04: 52026-08-05: 22026-08-06: 42026-08-07: 22026-08-08: 22026-08-09: 62026-08-10: 102026-08-11: 52026-08-12: 02026-08-13: 12026-08-14: 72026-08-15: 02026-08-16: 62026-08-17: 22026-08-18: 72026-08-19: 02026-08-20: 32026-08-21: 02026-08-22: 12026-08-23: 12026-08-24: 52026-08-25: 12026-08-26: 22026-08-27: 02026-08-28: 12026-08-29: 02026-08-30: 02026-08-31: 22026-09-01: 22026-09-02: 12026-09-03: 22026-09-04: 12026-09-05: 142026-09-06: 82026-09-07: 42026-09-08: 22026-09-09: 02026-09-10: 22026-09-11: 52026-09-12: 22026-09-13: 12026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 42026-09-18: 02026-09-19: 12026-09-20: 12026-09-21: 22026-09-22: 12026-09-23: 02026-09-24: 02026-09-25: 12026-09-26: 02026-09-27: 32026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 22026-10-05: 02026-10-06: 02026-10-07: 52026-10-08: 02026-10-09: 42026-10-10: 32026-10-11: 32026-10-12: 12026-10-13: 162026-10-14: 22026-10-15: 32026-10-16: 32026-10-17: 02026-10-18: 02026-10-19: 32026-10-20: 02026-10-21: 02026-10-22: 0
Telegram phishing domains detected per day: 216 from 2026-07-25 to 2026-10-22; peak 16.

How to tell a fake Telegram site

Official domains: telegram.org, t.me.

Words most often added to the brand in reported domains: aml, usdai, buytrx, trx, claim, teiegtm, duplicate, disabled, tron, verificar.

  • Type the address yourself or use a bookmark; phishing links for Telegram arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Telegram does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Telegram phishing domains

The 50 most recently detected domains impersonating Telegram
DomainFirst detectedStatus at last checkRegistrar
nox.tech2026-10-19OnlineNAMECHEAP
nox.work2026-10-19OnlineNAMECHEAP
nox.expert2026-10-19OnlineNameCheap
mrking11050.com2026-10-16UnknownNICENIC
myxavpn.com2026-10-16OnlineRegistrar of Domain Names REG.RU
rajaslotoplay.makeup2026-10-16OnlineNameSilo
geraytuinfinity.work2026-10-15OnlineCloudflare
pumplive-streams.fun2026-10-15OfflineNameSilo
beyondcvv.com2026-10-15OnlineNICENIC
upnetworkhq.xyz2026-10-14OnlineGlobal Domain
hgdj9.wiki2026-10-14OnlineNameSilo
mrking20056.com2026-10-13OnlineTUCOWS.COM
tokenairdrop.info2026-10-13OnlineNameSilo
pornocudayi56.com2026-10-13OnlineNICENIC
livepumpfun.solander.cc2026-10-13UnknownNICENIC
parik24-ukrain.com.ua2026-10-13OnlineТОВ "ХОСТІНГ УКРАЇНА"
bezopasnet.space2026-10-13OnlineRegistrar of Domain Names REG.RU
tunnelbase.space2026-10-13OnlineRegistrar of Domain Names REG.RU
routeshield.space2026-10-13OnlineRegistrar of Domain Names REG.RU
pauktun.space2026-10-13OnlineRegistrar of Domain Names REG.RU
spidervpn.online2026-10-13OnlineRegistrar of Domain Names REG.RU
myxavpn.space2026-10-13OnlineRegistrar of Domain Names REG.RU
stableproxy.space2026-10-13OnlineRegistrar of Domain Names REG.RU
myxavpn.online2026-10-13OnlineRegistrar of Domain Names REG.RU
netroutehub.space2026-10-13OnlineRegistrar of Domain Names REG.RU
vaultvpn.space2026-10-13OnlineRegistrar of Domain Names REG.RU
sverchvpn.space2026-10-13OnlineRegistrar of Domain Names REG.RU
lrservice.com.ua2026-10-12OnlineInternet Invest
webs3coinme.vip2026-10-11OnlineNameMart
drivespa.ru2026-10-11Online—
lemapfrance.org2026-10-11OfflineNAMECHEAP
advokatemelyanov.ru2026-10-10OnlineREGRU-RU
fixedfloat-eu.com2026-10-10OnlineRegistrar.eu
sollivepump.fun2026-10-10OnlineNameSilo
novachange.pro2026-10-09OnlineGNAME.COM
webs3coinme.lol2026-10-09OnlineNameMart
trx.bi2026-10-09OnlineDynadot
telebxes.com2026-10-09UnknownNICENIC
belfortforex.online2026-10-07OnlineNICENIC
kettixblock.com2026-10-07OnlineNICENIC
vpn-zero.run2026-10-07OnlineNICENIC
firstshot.digital2026-10-07OnlineNICENIC
mgmarket-6.at2026-10-07Online—
webs3coinme.xin2026-10-04OnlineNameMart
webs3coinme.cc2026-10-04OnlineDominet (HK)
linkedpayservices.com2026-09-27OnlineCloudflare
linkedpaycheck.com2026-09-27OnlineCloudflare
linked-pay-service.com2026-09-27OnlineCloudflare
fundrecoveryagent.com2026-09-25OnlineSpaceship
thelemmings.net2026-09-22OnlineGoDaddy.com

All 1,170 Telegram reports

Where they are registered and hosted

Registrars

  1. NICENIC125
  2. Cloudflare94
  3. NiceNIC70
  4. NameCheap61
  5. Trustname.com60
  6. Gname.com50
  7. NameSilo49
  8. PublicDomainRegistry.com36

Top-level domains

  1. .com339
  2. .dev86
  3. .org58
  4. .sbs58
  5. .ru41
  6. .net38
  7. .xyz37
  8. .top31

Hosting networks

  1. Cloudflare, Inc.329
  2. CLOUDFLARENET, US171
  3. CLOUDFLARENET - Cloudflare, Inc., US108
  4. AMAZON-02 - Amazon.com, Inc., US54
  5. DDOS-GUARD LTD32
  6. AS-COLOCROSSING, US29
  7. AMAZON-02, US25
  8. Telegram Telegram Messenger Inc, VG23

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Telegram; share of all PhishDestroy reports: 0.52%.