m[.]dtwyiqnl9ods[.]com

This domain, m.dtwyiqnl9ods.com, poses a specific threat of brand impersonation, targeting the Telegram brand. The domain was created on June 21, 2021, and is currently offline. Analysis indicates that it was used to deceive users into believing they were interacting with an official Telegram service, potentially leading to credential theft or other malicious activities.

Evidence supporting the brand impersonation threat includes the domain being flagged by 18 out of 95 security vendors on VirusTotal. It is registered through GoDaddy.com, LLC, and was first created on June 21, 2021. The domain appears on 2 security blocklists, specifically PhishDestroy and PhishingDB. The IP address it resolved to, 172.65.201.65, is located in the United States and is associated with Cloudflare, Inc. The SSL certificate, issued by Sectigo Limited, further highlights the sophistication of the impersonation attempt. Despite being taken offline, the domain's history and current status indicate a deliberate and malicious intent to impersonate Telegram.

If users have visited m.dtwyiqnl9ods.com, it is recommended that they immediately change their Telegram account passwords and enable two-factor authentication (2FA). Users should also monitor their account for any unauthorized activity and report any suspicious incidents to Telegram's support team. Additionally, users should be cautious of similar-looking domains and verify the authenticity of websites by checking the URL and SSL certificate details before entering any sensitive information.