# Phishing sites impersonating Telegram PhishDestroy has recorded 1,170 phishing domains impersonating Telegram since 2025-07-09, 50 of them in the last 30 days. The most used registrars are NICENIC and Cloudflare; the most common TLDs are .com and .dev. The official Telegram domain is telegram.org: any other site asking for your login or wallet is not Telegram. 1,170Domains, all time 50Last 30 days 593Online at last check 143Confirmed takedowns ## New domains in the last 90 days Telegram phishing domains detected per day: 216 from 2026-07-25 to 2026-10-22; peak 16. ## How to tell a fake Telegram site Official domains: telegram.org, t.me. Words most often added to the brand in reported domains: aml, usdai, buytrx, trx, claim, teiegtm, duplicate, disabled, tron, verificar. - Type the address yourself or use a bookmark; phishing links for Telegram arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Telegram does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Telegram phishing domains The 50 most recently detected domains impersonating Telegram Domain | First detected | Status at last check | Registrar | [nox.tech](https://phishdestroy.io/domain/nox.tech/) | 2026-10-19 | Online | NAMECHEAP | [nox.work](https://phishdestroy.io/domain/nox.work/) | 2026-10-19 | Online | NAMECHEAP | [nox.expert](https://phishdestroy.io/domain/nox.expert/) | 2026-10-19 | Online | NameCheap | [mrking11050.com](https://phishdestroy.io/domain/mrking11050.com/) | 2026-10-16 | Unknown | NICENIC | [myxavpn.com](https://phishdestroy.io/domain/myxavpn.com/) | 2026-10-16 | Online | Registrar of Domain Names REG.RU | [rajaslotoplay.makeup](https://phishdestroy.io/domain/rajaslotoplay.makeup/) | 2026-10-16 | Online | NameSilo | [geraytuinfinity.work](https://phishdestroy.io/domain/geraytuinfinity.work/) | 2026-10-15 | Online | Cloudflare | [pumplive-streams.fun](https://phishdestroy.io/domain/pumplive-streams.fun/) | 2026-10-15 | Offline | NameSilo | [beyondcvv.com](https://phishdestroy.io/domain/beyondcvv.com/) | 2026-10-15 | Online | NICENIC | [upnetworkhq.xyz](https://phishdestroy.io/domain/upnetworkhq.xyz/) | 2026-10-14 | Online | Global Domain | [hgdj9.wiki](https://phishdestroy.io/domain/hgdj9.wiki/) | 2026-10-14 | Online | NameSilo | [mrking20056.com](https://phishdestroy.io/domain/mrking20056.com/) | 2026-10-13 | Online | TUCOWS.COM | [tokenairdrop.info](https://phishdestroy.io/domain/tokenairdrop.info/) | 2026-10-13 | Online | NameSilo | [pornocudayi56.com](https://phishdestroy.io/domain/pornocudayi56.com/) | 2026-10-13 | Online | NICENIC | [livepumpfun.solander.cc](https://phishdestroy.io/domain/livepumpfun.solander.cc/) | 2026-10-13 | Unknown | NICENIC | [parik24-ukrain.com.ua](https://phishdestroy.io/domain/parik24-ukrain.com.ua/) | 2026-10-13 | Online | ТОВ "ХОСТІНГ УКРАЇНА" | [bezopasnet.space](https://phishdestroy.io/domain/bezopasnet.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [tunnelbase.space](https://phishdestroy.io/domain/tunnelbase.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [routeshield.space](https://phishdestroy.io/domain/routeshield.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [pauktun.space](https://phishdestroy.io/domain/pauktun.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [spidervpn.online](https://phishdestroy.io/domain/spidervpn.online/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [myxavpn.space](https://phishdestroy.io/domain/myxavpn.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [stableproxy.space](https://phishdestroy.io/domain/stableproxy.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [myxavpn.online](https://phishdestroy.io/domain/myxavpn.online/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [netroutehub.space](https://phishdestroy.io/domain/netroutehub.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [vaultvpn.space](https://phishdestroy.io/domain/vaultvpn.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [sverchvpn.space](https://phishdestroy.io/domain/sverchvpn.space/) | 2026-10-13 | Online | Registrar of Domain Names REG.RU | [lrservice.com.ua](https://phishdestroy.io/domain/lrservice.com.ua/) | 2026-10-12 | Online | Internet Invest | [webs3coinme.vip](https://phishdestroy.io/domain/webs3coinme.vip/) | 2026-10-11 | Online | NameMart | [drivespa.ru](https://phishdestroy.io/domain/drivespa.ru/) | 2026-10-11 | Online | — | [lemapfrance.org](https://phishdestroy.io/domain/lemapfrance.org/) | 2026-10-11 | Offline | NAMECHEAP | [advokatemelyanov.ru](https://phishdestroy.io/domain/advokatemelyanov.ru/) | 2026-10-10 | Online | REGRU-RU | [fixedfloat-eu.com](https://phishdestroy.io/domain/fixedfloat-eu.com/) | 2026-10-10 | Online | Registrar.eu | [sollivepump.fun](https://phishdestroy.io/domain/sollivepump.fun/) | 2026-10-10 | Online | NameSilo | [novachange.pro](https://phishdestroy.io/domain/novachange.pro/) | 2026-10-09 | Online | GNAME.COM | [webs3coinme.lol](https://phishdestroy.io/domain/webs3coinme.lol/) | 2026-10-09 | Online | NameMart | [trx.bi](https://phishdestroy.io/domain/trx.bi/) | 2026-10-09 | Online | Dynadot | [telebxes.com](https://phishdestroy.io/domain/telebxes.com/) | 2026-10-09 | Unknown | NICENIC | [belfortforex.online](https://phishdestroy.io/domain/belfortforex.online/) | 2026-10-07 | Online | NICENIC | [kettixblock.com](https://phishdestroy.io/domain/kettixblock.com/) | 2026-10-07 | Online | NICENIC | [vpn-zero.run](https://phishdestroy.io/domain/vpn-zero.run/) | 2026-10-07 | Online | NICENIC | [firstshot.digital](https://phishdestroy.io/domain/firstshot.digital/) | 2026-10-07 | Online | NICENIC | [mgmarket-6.at](https://phishdestroy.io/domain/mgmarket-6.at/) | 2026-10-07 | Online | — | [webs3coinme.xin](https://phishdestroy.io/domain/webs3coinme.xin/) | 2026-10-04 | Online | NameMart | [webs3coinme.cc](https://phishdestroy.io/domain/webs3coinme.cc/) | 2026-10-04 | Online | Dominet (HK) | [linkedpayservices.com](https://phishdestroy.io/domain/linkedpayservices.com/) | 2026-09-27 | Online | Cloudflare | [linkedpaycheck.com](https://phishdestroy.io/domain/linkedpaycheck.com/) | 2026-09-27 | Online | Cloudflare | [linked-pay-service.com](https://phishdestroy.io/domain/linked-pay-service.com/) | 2026-09-27 | Online | Cloudflare | [fundrecoveryagent.com](https://phishdestroy.io/domain/fundrecoveryagent.com/) | 2026-09-25 | Online | Spaceship | [thelemmings.net](https://phishdestroy.io/domain/thelemmings.net/) | 2026-09-22 | Online | GoDaddy.com | [All 1,170 Telegram reports](https://phishdestroy.io/domain/?brand=Telegram) ## Where they are registered and hosted ### Registrars - [NICENIC](https://phishdestroy.io/registrar/nicenic/)125 - Cloudflare94 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)70 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)61 - [Trustname.com](https://phishdestroy.io/registrar/trustname/)60 - [Gname.com](https://phishdestroy.io/registrar/name-com/)50 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)49 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)36 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)339 - [.dev](https://phishdestroy.io/tld/dev/)86 - [.org](https://phishdestroy.io/tld/org/)58 - [.sbs](https://phishdestroy.io/tld/sbs/)58 - [.ru](https://phishdestroy.io/tld/ru/)41 - [.net](https://phishdestroy.io/tld/net/)38 - [.xyz](https://phishdestroy.io/tld/xyz/)37 - [.top](https://phishdestroy.io/tld/top/)31 ### Hosting networks - Cloudflare, Inc.329 - CLOUDFLARENET, US171 - CLOUDFLARENET - Cloudflare, Inc., US108 - AMAZON-02 - Amazon.com, Inc., US54 - DDOS-GUARD LTD32 - AS-COLOCROSSING, US29 - AMAZON-02, US25 - Telegram Telegram Messenger Inc, VG23 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Telegram; share of all PhishDestroy reports: 0.52%. Canonical: https://phishdestroy.io/brand/telegram/