us57webzoom[.]us

This domain, us57webzoom.us, is identified as a brand impersonation phishing site targeting Telegram users. Analysis confirms the domain was actively designed to mimic Telegram’s official branding, likely to harvest credentials or distribute malicious payloads. Current status indicates the domain has been taken offline, but prior activity warrants continued monitoring due to its elevated risk classification. Infrastructure analysis reveals the domain was registered through Dynadot LLC on December 18, 2025, and resolved to the IP address 87.236.16.18, hosted under AS198610 (Beget LLC) in Russia. The domain appears on one security blocklist and is flagged by 11 of 95 security vendors on VirusTotal. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for threat actors due to its low barrier to entry. The page title, 'The new site has been successfully created and is ready to work,' suggests the domain was prepared for imminent malicious deployment before being disrupted. While us57webzoom.us is currently offline, organizations and users should treat any residual references to this domain as high-risk. Immediate actions include blocking the domain and its associated IP (87.236.16.18) at the network perimeter, updating endpoint protection rules to detect Telegram-themed phishing attempts, and conducting retrospective log analysis for prior interactions. Users who may have engaged with the domain should reset credentials for Telegram and any associated accounts, enable multi-factor authentication, and monitor for unauthorized activity. Given the domain’s recent creation and rapid flagging by security vendors, further iterations or successor domains may emerge under similar naming conventions.