telpdvq[.]sbs

This domain, telpdvq.sbs, is identified as a credential theft operation targeting Telegram users. Analysis indicates the infrastructure was designed to mimic Telegram's authentication portal, likely harvesting login credentials for account takeover or further malicious activity. The page title 'Loading...' suggests a placeholder or obfuscation technique to delay detection while the phishing kit loads in the background. No direct evidence of a crypto drainer kit was observed, but the Telegram SSL certificate association strengthens the likelihood of brand impersonation for credential harvesting. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 14, 2026, a future date that may indicate falsified registration details or a system error. It resolves to the IP address 216.150.1.1, a host with prior associations to malicious activity. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on two security blocklists and is currently blocked by PhishDestroy and OISD. No entries were found in Google Safe Browsing at the time of analysis, though this may reflect detection latency rather than benign status. The domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. The use of a Telegram SSL certificate suggests the attackers may have compromised legitimate credentials or employed deceptive tactics to obtain them. Users who may have interacted with this domain should immediately reset their Telegram credentials and enable multi-factor authentication. Organizations are advised to block the domain and IP at the network level and monitor for related indicators of compromise.