teleqmaz[.]sbs

This domain, teleqmaz.sbs, is flagged as a phishing infrastructure impersonating the Telegram messaging platform. Analysis indicates the use of brand-specific elements, including an SSL certificate labeled 'Telegram,' suggesting an intent to deceive users into believing they are interacting with legitimate Telegram services. The domain does not exhibit direct indicators of a crypto drainer kit but aligns with generic phishing tactics designed to harvest credentials or distribute malicious payloads under the guise of a trusted brand. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 216.150.1.1 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 14, 2026, an anomalous creation date that may indicate domain spoofing or backdating. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. No entries were found in Google Safe Browsing at the time of assessment, though this does not preclude prior or future listings. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated with minimal effort. The SSL certificate, while mimicking Telegram, does not provide cryptographic assurance of legitimacy, and the anomalous creation date further undermines trust. Organizations are advised to maintain blocklist entries for this domain and monitor for re-emergence. Users should verify SSL certificate details and domain registration dates when accessing sensitive services, particularly those associated with messaging platforms or financial transactions. Proactive DNS monitoring for related subdomains or IP associations is recommended to detect potential resurgence.