telepxju[.]sbs

This domain, telepxju.sbs, operates as a fake Telegram login portal designed to harvest user credentials. Analysis indicates the site mimics Telegram’s authentication interface, presenting a deceptive login form that captures entered usernames and passwords. The domain’s infrastructure and SSL certificate, issued under the name 'Telegram,' further reinforce the impersonation attempt, increasing the likelihood of successful social engineering attacks against unsuspecting users seeking legitimate Telegram services. Technical evidence confirms the malicious nature of telepxju.sbs. The domain was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The site resolves to the IP address 216.150.1.1, and its SSL certificate, though issued under the 'Telegram' name, does not correspond to Telegram’s official infrastructure. The page title 'Loading...' suggests an attempt to delay detection or simulate a legitimate loading process. Users who visited telepxju.sbs should assume their credentials have been compromised. Immediate steps include changing passwords for Telegram and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to mitigate further risk. Monitor financial and communication platforms for unauthorized activity, as stolen credentials may be leveraged for follow-up attacks, including account takeovers or phishing campaigns targeting contacts. If personal or financial data was entered, consider reporting the incident to relevant authorities and credit monitoring services to prevent identity theft.