rer11ta[.]sbs

This domain, rer11ta.sbs, is identified as a credential theft operation targeting users of the Telegram messaging platform. Analysis indicates the site mimics Telegram’s login interface to harvest user credentials, including usernames, passwords, and potentially two-factor authentication codes. No evidence of a crypto drainer kit or wallet redirection was observed, distinguishing it from financially motivated phishing campaigns. The domain’s infrastructure and page title strongly suggest a focus on account takeover rather than direct financial theft. Infrastructure analysis reveals the following technical indicators: the domain was registered through Gname.com Pte. Ltd. on March 19, 2026, and resolves to the IP address 172.67.218.254, hosted behind a content delivery network in California. At the time of assessment, rer11ta.sbs lacked an SSL certificate, increasing the likelihood of interception of unencrypted credentials. VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No entries were found in Google Safe Browsing at the time of this report. The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. While the immediate threat has been mitigated, the infrastructure remains registered until 2026, leaving open the possibility of reactivation. Users who accessed the site prior to its takedown should assume their credentials were compromised and take immediate remediation steps, including password resets and account monitoring. Organizations should update blocklists to include rer11ta.sbs and its associated IP to prevent future access attempts. Continuous monitoring of newly registered domains with similar naming patterns (e.g., random alphanumeric strings followed by .sbs) is recommended to detect potential follow-up campaigns.