telepdsrn[.]com

This domain is flagged as a high-risk phishing site specializing in Telegram Messenger impersonation. Analysis indicates the site mimics legitimate Telegram login pages to harvest credentials, leveraging brand trust to deceive users into entering sensitive account information. The threat type aligns with fake login portals, a common vector for account takeovers and subsequent fraud or espionage. Infrastructure analysis reveals the domain www.telepdsrn.com resolves to IP address 27.124.47.186 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 21, 2026, an unusually future-dated creation timestamp that may indicate registration irregularities. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, with detection signatures including phishing, brand impersonation, and fraudulent login pages. The SSL certificate is falsely presented as belonging to Telegram, further corroborating the impersonation attempt. The domain remains active with no current blocklist delistings, and no trust scores from reputable threat intelligence platforms have been recorded. Mitigation requires immediate action from network security teams. Block the domain and its resolving IP (27.124.47.186) at firewall and DNS levels to prevent user access. Security awareness programs should alert users to verify domain authenticity before entering credentials, particularly for messaging platforms. Monitor for SSL certificate mismatches, as the presence of a Telegram-branded certificate on a non-Telegram domain is a critical indicator of compromise. Incident response teams should investigate any prior access to this domain within their networks, focusing on credential exposure and potential lateral movement risks. If internal systems have interacted with this domain, initiate password resets and multi-factor authentication enforcement for affected accounts.