telgnewc[.]sbs

The domain telgnewc.sbs has been identified as a credential theft operation specifically targeting Telegram users. Analysis indicates the site was designed to impersonate Telegram’s login interface, tricking victims into submitting their account credentials. The domain is currently offline, though its prior activity and infrastructure warrant continued scrutiny. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 14, 2026, an unusually future-dated registration that may indicate evasion tactics. It resolved to the IP address 216.150.1.1 and was flagged by 10 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and holds a trust score of 0/100. The SSL certificate was issued under the name Telegram, further supporting the brand impersonation scheme. The page title, 'Loading...', suggests a placeholder or obfuscation technique to delay detection. The current offline status does not eliminate the risk posed by this domain, as threat actors frequently reactivate infrastructure for subsequent campaigns. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users who may have interacted with the site should reset their Telegram credentials immediately and enable multi-factor authentication. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP, as these may indicate further credential theft operations.