telegkel[.]com

This domain is an active phishing site designed to impersonate Telegram Messenger login pages. Visitors are presented with a fraudulent interface that closely resembles the legitimate Telegram web or mobile login portal, tricking users into entering their credentials. The site may also prompt for additional sensitive information such as two-factor authentication codes or recovery phrases, enabling attackers to gain full control of victim accounts. The primary threat is account takeover, which can lead to unauthorized access, data theft, or further phishing attacks targeting contacts within the compromised account. Analysis indicates the domain was registered on May 31, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 27.124.47.186 and uses an SSL certificate labeled 'Telegram,' likely to enhance the illusion of legitimacy. While VirusTotal currently shows 0 detections out of 95 security engines, Google Safe Browsing has flagged the site for SOCIAL_ENGINEERING, and it appears on one security blocklist. The page title 'Messenger' further supports the intent to deceive users into believing they are accessing a genuine messaging service. If a user has visited telegkel.com and entered any credentials or personal information, immediate action is required. The user should log out of all active Telegram sessions from a trusted device and change their password using the official Telegram application or website. Enabling two-factor authentication (2FA) with an authenticator app, rather than SMS, is strongly recommended. All devices should be scanned for malware, and any suspicious browser extensions or applications should be removed. Users should also monitor their accounts for unauthorized activity and warn contacts about potential phishing messages sent from their account.