invite-counter[.]xyz

This domain, invite-counter.xyz, is flagged as a credential theft operation specifically targeting Telegram users. Analysis indicates the infrastructure mimics legitimate Telegram group invitation pages, using the page title 'Telegram: Join Group Chat' to deceive victims into entering account credentials. No direct evidence of a crypto drainer kit was observed, but the credential harvesting mechanism aligns with common phishing tactics used to compromise messaging accounts for subsequent malicious activity, such as spreading malware or conducting social engineering attacks. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 16, 2026, through Global Domain Group LLC and resolves to IP address 172.67.221.135. VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, and the site was built using Bootstrap, a common framework that may help evade basic detection mechanisms. Google Safe Browsing (GSB) status is not explicitly provided but is likely marked as unsafe given the other indicators. As of the latest assessment, invite-counter.xyz has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered, and similar campaigns may resurface under different domains or IPs. Users who interacted with the site should assume credential compromise and take immediate action, including password resets and enabling multi-factor authentication on affected accounts. Organizations are advised to monitor for related domains registered through the same registrar and block the associated IP address (172.67.221.135) in network defenses. The elevated risk level persists due to the potential for credential reuse across other platforms.