telgydes[.]sbs

The domain telgydes.sbs has been identified as a Telegram credential phishing site. Analysis indicates the infrastructure was actively targeting users under the guise of the Telegram messaging platform. The domain is currently offline, though prior activity suggests it was operational for a limited period. Infrastructure analysis reveals multiple high-risk indicators. The domain was flagged by 12 of 95 security vendors on VirusTotal, indicating broad detection across the security community. It was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 216.150.1.1. The SSL certificate is issued under the name Telegram, further suggesting an attempt to impersonate the legitimate service. The domain appears on one security blocklist, and its trust score is 0/100, reinforcing its malicious classification. The domain is currently offline, though its infrastructure remains a potential risk for future abuse. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP. If the domain reactivates, immediate takedown procedures should be initiated. Users who may have interacted with the site should reset credentials and enable multi-factor authentication on affected accounts.