telepqim[.]sbs

This domain, telepqim.sbs, is identified as a credential phishing site specifically targeting users of the messaging platform Telegram. The infrastructure analysis reveals the use of a fraudulent SSL certificate impersonating Telegram, designed to deceive users into entering sensitive login information. The site employs social engineering tactics, likely presenting itself as an official Telegram login page or security verification portal, to harvest credentials for unauthorized account access or further malicious activities such as spam distribution or financial fraud. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 7 out of 95 security vendors on VirusTotal, indicating broad recognition of its malicious nature. It was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Additionally, the domain appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. The detected technologies include Vercel for hosting and HTTP Strict Transport Security (HSTS), which may be used to lend an air of legitimacy to the phishing attempt. The domain currently resolves to the IP address 216.150.1.1, which has been linked to other phishing campaigns in recent threat intelligence reports. Users who have visited telepqim.sbs or entered credentials on the site should take immediate action to mitigate potential risks. First, change the password for the affected Telegram account and enable two-factor authentication if not already active. Monitor the account for any unauthorized activity, such as unusual messages or login attempts from unfamiliar locations. Additionally, review connected devices and applications for any signs of compromise. If financial or personally identifiable information was entered, consider placing a fraud alert on credit files and monitoring for signs of identity theft. Finally, ensure that security software is up to date and perform a full system scan to detect any potential malware infections that may have been introduced during the interaction with the phishing site.