nonesecure[.]xyz

PhishDestroy has identified nonesecure.xyz as a credential phishing site specifically designed to steal Telegram login credentials by impersonating the official Telegram group join page. The domain is currently offline, but it posed a significant threat to users attempting to join Telegram groups. The site masqueraded as the legitimate Telegram interface to harvest usernames and passwords, putting victims at risk of account compromise and unauthorized access to their private messages and contacts.

The domain nonesecure.xyz was registered through Dynadot LLC on April 28, 2026, and was flagged by 9 of 95 security vendors on VirusTotal, indicating a high probability of malicious activity. It was also listed on one security blocklist and resolved to the IP address 188.114.97.3. The site used a Let's Encrypt SSL certificate (serial E7) to appear legitimate, which is a common tactic among phishing operations. These technical indicators together confirm that nonesecure.xyz was a malicious domain created for credential theft.

Although nonesecure.xyz has been taken offline, users should remain cautious. Anyone who may have visited the site and entered Telegram credentials should immediately change their Telegram password and enable two-factor authentication. PhishDestroy recommends always verifying URLs before entering login information, especially when redirected from unsolicited messages. Staying informed about such threats helps protect against future phishing attempts.