forzaservice[.]net

Analysis of the domain forzaservice.net indicates active brand impersonation targeting Telegram users, classified as high-risk infrastructure. Registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com, the domain resolves to IP address 188.114.97.3 and is protected by Cloudflare, including HTTP/3 and Cloudflare Browser Insights technologies. The page title, 'Telegram Login Proxy,' directly suggests an attempt to mimic Telegram's authentication process, though the exact content and functionality of the site remain unconfirmed due to lack of direct analysis. Infrastructure reveals the use of a Google Trust Services SSL certificate, which does not inherently indicate malicious intent but is commonly leveraged by threat actors to appear legitimate. The domain has been flagged in 23 AlienVault OTX threat intelligence pulses, indicating prior detection by security researchers. Additionally, it appears on two security blocklists and is actively blocked by PhishDestroy and BLP-Malware. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. While four out of 95 security vendors on VirusTotal flag the domain, this detection rate alone does not provide conclusive evidence of its specific payload or behavior. The domain remains operational as of July 12, 2026, posing an ongoing risk to users who may encounter it through phishing campaigns. Defenders are advised to block the domain at the network level and monitor for associated indicators of compromise, including the resolving IP and SSL certificate details. Further investigation into its distribution methods and payload delivery mechanisms is recommended to mitigate potential credential theft or account compromise.