invite-tracker[.]sbs

The domain invite-tracker.sbs was engaged in brand impersonation, specifically targeting Telegram users through deceptive tactics. This domain mimicked legitimate Telegram functionalities by displaying the page title "Telegram: Join Group Chat," aiming to deceive users into divulging sensitive information. The threat was categorized as elevated due to its potential to mislead users into believing they were interacting with the actual Telegram platform.

Technical indicators of this phishing campaign include registration through Dynadot LLC and resolution to the IP address 188.114.97.3. The domain was created on May 13, 2026, suggesting it was recently established for malicious purposes. VirusTotal analysis revealed that 14 out of 95 security vendors flagged invite-tracker.sbs, indicating broad recognition of its threat profile. Additionally, it has been identified in one threat intelligence pulse on AlienVault OTX and appears on one security blocklist, further confirming its malicious intent.

Currently, the domain invite-tracker.sbs is offline, having been blocked by PhishDestroy. While the domain's immediate threat has been mitigated, the incident underscores the importance of vigilance against such impersonation schemes. Security professionals are advised to monitor similar domains and IP addresses to preemptively disrupt future attempts. Maintaining updated blocklists and threat intelligence databases can help minimize residual risks from similar threats.