telesqyi[.]sbs

The domain telesqyi.sbs has been identified as a phishing infrastructure specifically designed to impersonate Telegram, a widely used messaging platform. Analysis indicates this domain operates under the generic_phishing threat category, targeting users through deceptive interfaces mimicking legitimate Telegram services. As of the most recent assessment, the domain has been taken offline, though residual risk may persist due to prior exposure. Infrastructure analysis reveals several high-risk indicators associated with telesqyi.sbs. The domain was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in malicious campaigns. It resolves to the IP address 216.150.1.1, which has been linked to other suspicious activities. The domain appears on one security blocklist and is flagged by 14 of 95 security vendors on VirusTotal, indicating moderate to high detection coverage. Additionally, the SSL certificate is issued under the name Telegram, further suggesting an attempt to deceive users into believing the site is legitimate. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as malicious. Current status confirms that telesqyi.sbs is offline, reducing immediate exposure risk. However, organizations and individuals are advised to implement proactive measures to mitigate potential fallout from this campaign. Network administrators should update firewall rules and DNS filters to block the domain and its associated IP address. End-users are urged to verify the authenticity of any communication or login prompts claiming affiliation with Telegram, particularly those received via unsolicited messages. Security teams should monitor for indicators of compromise, including the domain, IP, and SSL certificate details, to prevent recurrence or related attacks.