telegurr[.]com

This domain is flagged as a high-risk phishing infrastructure impersonating Telegram Messenger to harvest user credentials. Analysis indicates a targeted fake login scheme, where victims are lured into entering sensitive account details under the pretense of accessing a legitimate messaging service. The domain exhibits multiple technical indicators consistent with credential theft operations, including the use of Telegram branding in its SSL certificate and a page title explicitly labeled 'Messenger.' Infrastructure analysis reveals critical red flags: the domain telegurr.com was registered on May 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It currently resolves to the IP address 27.124.47.186, which has been linked to prior phishing campaigns. VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious, a significant indicator of its fraudulent nature. The SSL certificate, while appearing legitimate at first glance, is a common tactic used to deceive users into trusting the site. No legitimate trust scores or blocklist exemptions have been identified, further confirming its malicious intent. To mitigate risks associated with this fake Telegram login phishing site, users and organizations should immediately block access to telegurr.com at the network level. Security teams are advised to monitor for connections to the IP address 27.124.47.186 and investigate any associated outbound traffic. End-users should be educated on recognizing brand impersonation tactics, particularly the use of deceptive SSL certificates and domain names that mimic legitimate services. Multi-factor authentication (MFA) should be enforced for all accounts to reduce the impact of credential theft. If credentials were entered on this site, affected accounts must be secured immediately, and password resets should be performed across any platforms where the same credentials may have been reused.