MALICIOUS — HIGH
telegramtec[.]online
On July 23, 2026 analysts assessed telegramtec.online, a domain created on June 24, 2025, that is currently taken offline.
- VirusTotal
- 1/95
- Blocklists
- No stored match
- Verfügbarkeit
- Inhalt nicht verfügbar · HTTP 502
Do not enter credentials, seed phrases, payment details, or personal information on this domain.
Jump to section
telegramtec.online — Inhalt nicht verfügbar (HTTP 502). Markenidentität: Telegram; Betrugstyp: Social Media Phishing. Zusammenfassung der Beweislage: VirusTotal 1/95 (Gridinsoft); PhishDestroy score 55/100. Registrar: REGRU-RU.
Die ausführliche Analyse von PhishDestroy AI bleibt auf Englisch, damit der ursprüngliche forensische Bericht unverändert bleibt.
Evidence Analysis
telegramtec.online — Telegram Brand Impersonation Report
On July 23, 2026 analysts assessed telegramtec.online, a domain created on June 24, 2025, that is currently taken offline.
On July 23, 2026 analysts assessed telegramtec.online, a domain created on June 24, 2025, that is currently taken offline. The site presented the page title "Telegram Messenger" and is classified as a brand impersonation campaign targeting the Telegram service. Infrastructure analysis shows the domain resolves to the IPv6 address 2001:67c:4e8:f004::9, which is registered to an ASN located in the Netherlands (AS62041) and is associated with Telegram Messenger Inc. The domain is hosted on Cloudflare, as indicated by the authoritative nameservers aarav.ns.cloudflare.com and athena.ns.cloudflare.com, and was registered through the REGRU-RU registrar. No SSL certificate was observed for the domain, leaving communications unencrypted.
Reputation checks reveal a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already blocked the domain. VirusTotal scans show that one out of ninety‑five security vendors flagged telegramtec.online, confirming a detection but without detailed malware attribution. The risk level is marked as elevated, reflecting the potential for credential harvesting against Telegram users. While the offline status limits immediate threat execution, the observed infrastructure suggests the operators retain the capability to reactivate the domain or duplicate the setup elsewhere.
Defenders should continue to monitor the IP address and associated ASN for new activity, enforce blocklists that include telegramtec.online, and consider pre‑emptive domain‑based filtering for any future resolutions to the same IPv6 address. Additionally, organizations should educate users about unsolicited Telegram‑related login prompts and advise verification of URLs against official Telegram domains. The limited detection footprint underscores the need for continued vigilance, as the campaign’s low visibility may indicate a targeted or testing phase rather than broad distribution.
Stored source results
Recorded verdicts and infrastructure observations for this domain.
Datenabdeckung12 recorded checks
Pipeline zur Reaktion auf Sicherheitsbedrohungen
Status der öffentlichen Sperrliste
Gespeicherte Aufnahme
Domain-Intelligenz
Technische DetailsDNS, SSL-SANs, Zeitstempel
ICANN OVERSIGHT
Akkreditierung und RAA-Kontext
Akkreditierung und RAA-Kontext
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
VirusTotal-Analyse
Archivierte Beweise
Nachweise und externe BerichteIndependent lookups and source reports
Victim safety and official reportingImmediate actions and verified reporting channels
Wenn Sie Kontoanmeldeinformationen, persönliche oder Zahlungsinformationen eingegeben oder eine Datei von dieser Domain heruntergeladen haben, ergreifen Sie sofort Maßnahmen. Nachfolgend finden Sie Ressourcen, die Ihnen helfen, den Vorfall zu melden und sich zu schützen.
Melden Sie sich bei Ihren örtlichen Behörden
Wählen Sie Ihr Land aus, um Offizielle Kontakte im Bereich Cyberkriminalität oder einen Beschwerdeentwurf erstellen → zu erhalten.