tonnel[.]click

PhishDestroy identifies this domain, tonnel.click, as an elevated risk brand impersonation threat specifically designed to mimic the Telegram messaging platform. The domain was registered through Web Commerce Communications Limited and created on October 3, 2025, suggesting a recent and active malicious campaign. Its page title, 'Number,' is a clear attempt to deceive users into entering sensitive credentials under the guise of a Telegram login or verification page.

Technical indicators reveal that tonnel.click has no SSL certificate, making any data transmitted over the connection vulnerable to interception. The domain resolves to IP address 104.21.11.205 and is listed on two security blocklists, indicating known malicious activity. VirusTotal analysis shows that 7 out of 95 security vendors flag this domain as harmful, reinforcing its dangerous reputation. The domain is currently offline, but such threats often reappear under different domains or IPs.

Users who may have interacted with this domain should immediately change their Telegram password and enable two-factor authentication. Since this is a brand impersonation attack, victims should also monitor their accounts for unauthorized access and report any suspicious activity to Telegram's support team. Avoid clicking on links from unsolicited messages or emails claiming to be from Telegram, and always verify the URL before entering login credentials.