securitybot[.]vip

This domain, securitybot.vip, is identified as a targeted phishing infrastructure designed to impersonate Telegram group chat invitations. Analysis indicates the domain specifically mimics legitimate Telegram join pages, likely to harvest user credentials or distribute malicious payloads under the guise of a trusted messaging platform. The attack vector relies on social engineering, exploiting user trust in Telegram’s branding to prompt actions such as entering login details or downloading files. Evidence supporting this assessment includes detection by 17 out of 95 security vendors on VirusTotal, a trust score of 0/100 from Gridinsoft, and presence on one security blocklist. The domain was registered on April 24, 2026, through Dynadot Inc, and resolves to the IP address 188.114.97.3. Additionally, AlienVault OTX records the domain in two threat intelligence pulses, further confirming its malicious classification. The page title, 'Telegram: Join Group Chat,' directly aligns with the phishing theme, reinforcing the intent to deceive users. Users who visited securitybot.vip should immediately revoke any entered credentials and scan their systems for malware. If login details were submitted, reset passwords for Telegram and any accounts sharing the same credentials. Monitor financial and communication platforms for unauthorized access. Network administrators should block the domain and its associated IP (188.114.97.3) at the perimeter. Review logs for connections to securitybot.vip to identify compromised endpoints. Given the domain’s offline status, remain vigilant for similar phishing attempts using Telegram-themed lures.