support-telekom[.]app

This domain, support-telekom.app, is identified as a brand impersonation threat targeting Telekom customers. The site presents a counterfeit login interface designed to harvest user credentials, including usernames, passwords, and potentially two-factor authentication codes. Analysis indicates the page mimics legitimate Telekom authentication portals, increasing the likelihood of successful deception among unsuspecting users. The threat extends beyond immediate credential theft, as stolen data may facilitate follow-on attacks such as account takeovers, financial fraud, or unauthorized access to sensitive communications. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The site was registered on January 26, 2026, through Key-Systems GmbH, a registrar frequently associated with abusive registrations. It resolves to IP address 45.86.86.185, hosted on AS200019 (ALEXHOST SRL), an autonomous system with a history of sheltering phishing and malware distribution infrastructure. Notably, the domain lacks an SSL certificate, a critical security omission that exposes user-submitted data to interception. Security vendors have flagged the domain, with 25 out of 95 engines on VirusTotal detecting it as malicious, and it appears on at least one security blocklist. Users who visited support-telekom.app should take immediate action to mitigate potential risks. First, cease all interaction with the site and avoid entering any credentials. If login details were submitted, change passwords for Telekom accounts and any other services where identical credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Monitor financial statements and account activity for signs of unauthorized access. Report the incident to Telekom’s official security team to assist in tracking and mitigating the threat. Additionally, consider scanning local devices for malware, as some phishing sites deploy malicious scripts or payloads.