tel[.]26[.]hubs[.]vn

The domain tel.26.hubs.vn was registered on March 23, 2026 and resolves to the IPv4 address 103.239.122.26, which is geolocated to Vietnam and attributed to Shopeepay Joint Stock Company. The site presents a valid TLS certificate issued by Let’s Encrypt (R13) and returns HTTP 200 for the root path. The page title returned by the server is "Telegram Beta," directly mimicking the official Telegram branding.

Technical fingerprinting shows the web stack is built on Node.js with the Express framework, front‑ended by Nginx/OpenResty as the reverse proxy. The combination of these components is typical for low‑cost phishing kits. The domain’s Gridinsoft trust score is 0 out of 100, indicating a complete lack of reputational credibility. The site is classified as a credential‑phishing operation targeting Telegram users, leveraging the brand name to harvest login credentials.

Detection data reinforces the malicious intent: VirusTotal has flagged the domain in 12 out of 95 scanned security vendors, and the domain appears on a single blocklist, specifically PhishDestroy. The risk rating is set to high, and the current status is active, meaning the phishing page is still reachable. No additional intelligence about the hosting provider or upstream infrastructure is available beyond the observed IP location.

Defenders should immediately block tel.26.hubs.vn at perimeter and DNS filtering layers, and consider adding the IP address 103.239.122.26 to any network‑level deny lists. Continuous monitoring of traffic to this host is advised to detect potential credential submissions. Users should be warned about the fraudulent "Telegram Beta" page and instructed to verify URLs before entering credentials. Incident response teams may also sinkhole the domain to capture any further phishing attempts and support attribution efforts.