teljgl[.]com

This domain, teljgl.com, is confirmed to operate as a credential theft site specifically targeting Telegram users. Analysis indicates the domain impersonates Telegram's authentication interface, presenting a 'Loading...' page title to mask its malicious intent. The objective is to deceive users into entering their login credentials, which are then harvested by threat actors for unauthorized account access, data exfiltration, or further social engineering attacks. The use of Telegram's branding in the SSL certificate suggests a deliberate attempt to appear legitimate and lower user suspicion during the phishing attempt. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on June 13, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. VirusTotal detection metrics show 6 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and resolves to the IP address 216.150.1.1, which has been linked to prior phishing campaigns. The SSL certificate, while mimicking Telegram, lacks proper validation and is likely self-signed or issued by a non-trusted certificate authority. Users who visited teljgl.com or entered credentials on this site should assume their Telegram account has been compromised. Immediate action is required: revoke any active sessions via Telegram's security settings, enable two-factor authentication, and reset the account password using a unique, complex string. Monitor the account for unauthorized messages, contacts, or linked devices. If financial or sensitive personal data was shared, consider reporting the incident to relevant authorities and monitoring for signs of identity theft. Network administrators should block the domain and its resolving IP (216.150.1.1) at the perimeter to prevent further access.