telepanm[.]com

This domain, telepanm.com, is actively engaged in credential theft phishing operations targeting unsuspecting users. Analysis indicates the site mimics legitimate login portals to deceive visitors into submitting sensitive credentials, such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is designed to capture and exfiltrate this data to attacker-controlled servers, where it may be used for unauthorized account access, identity theft, or further malicious activities such as financial fraud or lateral movement within compromised networks.

Evidence supporting this assessment includes detection by 11 out of 95 security vendors on VirusTotal, a creation date of June 15, 2026, and registration through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain appears on at least one security blocklist and resolves to the IP address 216.150.1.1, hosted on AS16509 (Amazon.com, Inc.). The SSL certificate, issued by Let's Encrypt (YR2), provides minimal encryption but does not mitigate the underlying malicious intent. The page title, 'Loading...,' is a common tactic to delay user suspicion while backend scripts process stolen credentials.

Users who have visited telepanm.com or entered credentials on this site should immediately revoke any submitted information by changing passwords for all potentially affected accounts. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions, and report any suspicious behavior to the relevant service providers. If financial or personally identifiable information was exposed, consider placing a fraud alert or credit freeze with major credit bureaus to prevent further misuse.