brit[.]builltt[.]com

This domain, brit.builltt.com, poses a credential harvesting threat by impersonating the Telegram messaging platform. Analysis indicates the site was designed to deceive users into entering sensitive account details, such as login credentials or personal information, under the guise of a legitimate service. The page title 'vertexquests' suggests an attempt to mimic reward or promotional schemes, a common tactic to lure victims into interacting with malicious content. The domain’s infrastructure and design elements further support its fraudulent intent, as detailed below. Infrastructure analysis reveals brit.builltt.com was registered on September 26, 2025, through Dynadot LLC, a registrar frequently associated with phishing domains. The domain is flagged by 9 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It resolves to the IP address 198.23.193.170 and appears on at least one security blocklist. Detected technologies include Bootstrap, LiteSpeed, Cloudflare, and other frameworks commonly used to create convincing but fraudulent web pages. The Gridinsoft trust score of 0/100 further confirms its high-risk classification. Users who visited brit.builltt.com should take immediate action to mitigate potential risks. If any credentials or personal information were entered, change passwords for Telegram and any other accounts where the same credentials may have been reused. Enable multi-factor authentication where available to add an additional layer of security. Monitor financial and communication accounts for unusual activity, as compromised credentials could be exploited for further attacks. Additionally, scan the device used to access the site for malware, as phishing pages may distribute malicious payloads or redirect to exploit kits. Report the incident to relevant security teams or platforms to aid in broader threat mitigation efforts.