takura-app-telegram-panel[.]ru

Analysis of takura-app-telegram-panel.ru shows a short‑lived domain created on 21 February 2026 that was used to host a social‑media phishing page targeting Telegram users. The site’s only visible element is the page title “Участие в акции”, which translates to “Participation in the promotion”, a common lure for credential‑stealing campaigns. The domain resolves to IP 178.16.53.44, an address registered to Omegatech LTD in the Netherlands under ASN 202412. The hosting provider has not been publicly linked to other malicious infrastructure, but the single‑IP footprint is typical of fast‑flux or disposable phishing operators.

The SSL certificate presented is identified as “WE1”, indicating a weak or self‑signed certificate that offers no cryptographic assurance. The site was flagged by PhishDestroy and appears on one external blocklist, reinforcing the likelihood of malicious intent. VirusTotal scans recorded two detections out of ninety‑three scanners, confirming that at least a minority of security engines recognize the domain as malicious. The current HTTP status is offline, suggesting the operators have taken the site down, possibly after a brief campaign window.

Defenders should continue to block the domain and the associated IP at perimeter defenses, update URL filtering rules, and monitor for any resurgence of similar‑named domains that reuse the “telegram‑panel” pattern. Threat hunters should query passive DNS and SSL telemetry for the IP 178.16.53.44 and ASN 202412 for new hostnames, and SOC analysts should treat any inbound traffic claiming Telegram authentication from this host as compromised. Because the page content beyond the title has not been captured, further forensic collection is recommended if the site reappears, to identify any credential‑harvesting forms or payloads.