verifications-secure[.]top

The domain verifications-secure.top has been identified as a credential theft operation specifically targeting Telegram users. Analysis indicates the site masquerades as a legitimate Telegram group chat invitation page, tricking users into submitting login credentials. As of the latest assessment, the domain is currently offline, though prior activity suggests it was actively harvesting sensitive account information. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on May 4, 2026, through Global Domain Group LLC and resolves to the IP address 172.67.180.76. It appears on one security blocklist and has been flagged by 16 of 95 vendors on VirusTotal. Additional detection includes a Gridinsoft trust score of 0/100, further confirming its high-risk nature. Technologies detected on the domain include Bootstrap, Nginx, and HSTS, which may have been employed to lend an appearance of legitimacy while concealing malicious functionality. Given the domain's current offline status, immediate interaction risks are reduced; however, historical activity and infrastructure persistence remain concerning. Users who may have previously visited this domain should immediately reset Telegram credentials, enable multi-factor authentication, and review account activity for unauthorized access. Organizations should update security controls to block the domain and associated IP, while monitoring for similar patterns involving newly registered domains impersonating communication platforms. Proactive threat hunting for related infrastructure, such as domains registered through the same registrar or resolving to adjacent IP ranges, is recommended to mitigate future credential theft campaigns.