telelarp[.]com

This domain, telelarp.com, is identified as a credential phishing site designed to mimic the Messenger platform. Analysis indicates the site presents a fraudulent login interface under the page title 'Messenger,' aiming to deceive users into submitting account credentials. The infrastructure is engineered to closely resemble legitimate communication services, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Infrastructure analysis reveals the domain was registered on May 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 27.124.47.186 and is flagged by 16 out of 95 security vendors on VirusTotal, indicating elevated detection rates. The domain appears on one security blocklist and is referenced in a single threat intelligence pulse on AlienVault OTX. Notably, the SSL certificate is issued under the name 'Telegram,' further suggesting an attempt to lend false legitimacy to the phishing operation. Users who may have interacted with telelarp.com should immediately revoke any entered credentials and enable multi-factor authentication on their accounts. System administrators are advised to block the domain and its associated IP address (27.124.47.186) at the network level. Victims should monitor their accounts for unauthorized activity and report the incident to their organization’s security team or relevant authorities. Given the domain’s current offline status, continuous monitoring for reactivation attempts is recommended.