telegramzh[.]top

This domain, telegramzh.top, is flagged as a brand impersonation threat targeting Telegram, a widely used messaging platform. Analysis indicates the site was designed to harvest user credentials by mimicking legitimate Telegram login interfaces, as suggested by the page title containing non-ASCII characters interpreted as "Congratulations, site creation successful!" The threat type aligns with credential phishing, where attackers exploit brand trust to deceive users into submitting sensitive account details. Infrastructure analysis reveals the domain was registered on April 23, 2026, through NameMart Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 154.37.153.157, hosted within a netblock managed by NetLab Global, located in the United States. The domain is secured with an SSL certificate issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 hierarchy, which may lend a false sense of legitimacy. Detection metrics indicate 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional blocklist, specifically PhishDestroy. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown actions or infrastructure suspension. However, the elevated risk level persists due to the domain's recent creation date and the use of a registrar known for hosting malicious activity. Users who may have interacted with the site should immediately reset their Telegram credentials and enable multi-factor authentication. Organizations are advised to monitor for indicators of compromise, including the IP address 154.37.153.157 and the domain telegramzh.top, in network logs and endpoint detection systems. Proactive blocking of the domain and associated IP at the perimeter is recommended to prevent future access attempts.