telemwig[.]sbs

This domain, telemwig.sbs, is identified as a credential theft operation targeting users of the Telegram messaging platform. Analysis indicates the site mimics Telegram’s login interface to harvest user credentials, including usernames, passwords, and potentially two-factor authentication codes. Such attacks are designed to gain unauthorized access to personal accounts, enabling further exploitation such as data theft, financial fraud, or lateral movement into connected services. The domain’s infrastructure and SSL certificate, which falsely claims affiliation with Telegram, are key indicators of its malicious intent. Infrastructure analysis reveals that telemwig.sbs was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 216.150.1.1 and is currently flagged by 12 out of 95 security vendors on VirusTotal, including detections for phishing and credential theft. Additionally, the domain appears on one security blocklist, and its trust score is rated at 0/100, further confirming its malicious nature. The page title, 'Loading...,' suggests an attempt to evade detection by delaying the display of malicious content until after initial user interaction. Users who visited telemwig.sbs should assume their credentials have been compromised and take immediate action. First, change the password for any Telegram account accessed via this domain, and enable two-factor authentication if not already active. Monitor the account for unauthorized activity, such as messages sent from the account or changes to profile settings. Additionally, review other accounts that may share the same password, as attackers often reuse stolen credentials across multiple platforms. If financial or sensitive information was entered, consider placing a fraud alert on credit reports and notifying relevant institutions. Finally, scan the device used to access the domain for malware, as credential theft sites may deploy additional payloads to maintain persistence.