telegramauthh[.]ru

Analysis of telegramauthh.ru shows a newly registered domain created on 21 February 2026 that attempts to impersonate the Telegram brand. The HTTP response returned a page title of “Telegram Messenger”, matching the declared brand target. The site used a Go Daddy Secure Certificate Authority – G2 SSL certificate, which does not provide any indication of malicious intent but confirms the domain was served over HTTPS. Network resolution points to the IP address 149.154.167.99, which is registered to AS62041 in the Netherlands and is publicly associated with Telegram Messenger Inc. This overlap suggests the attackers deliberately leveraged a legitimate Telegram‑owned IP range to increase credibility. VirusTotal recorded detections from two of ninety‑three scanning engines, confirming that at least a minority of security products recognize the domain as malicious.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one community‑driven feed has flagged it. Current measurements show the domain is offline, which may be due to takedown actions or the operators temporarily disabling the site. Defenders should treat telegramauthh.ru as a confirmed brand‑impersonation vector targeting Telegram users. The presence of a valid SSL certificate and the use of a Telegram‑owned IP address increase the risk of successful credential harvesting through social‑media phishing campaigns.

Monitoring should include DNS queries for the domain and its IP, as well as correlation of any authentication attempts against Telegram accounts with traffic originating from the same address block. Organizations employing email or messaging security gateways should add the domain to block lists and ensure that URL filtering solutions reference the PhishDestroy block entry.