telehzyt[.]com

This domain is flagged as an elevated-risk credential theft operation specifically targeting Telegram users. Analysis indicates the infrastructure was designed to harvest login credentials by mimicking legitimate authentication portals, leveraging Telegram’s brand identity to deceive victims. The domain’s SSL certificate is registered under the name Telegram, reinforcing the impersonation tactic used to gain user trust. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 216.150.1.1 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 13, 2026, an anomalous future date suggesting potential registration fraud or data manipulation. VirusTotal reports 10 out of 95 security vendors have flagged telehzyt.com as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and is currently offline, though prior activity has been confirmed. The page title consistently displayed 'Loading...', a common tactic to mask malicious redirects or delayed payload execution. To mitigate credential theft risks associated with this domain, users should immediately revoke any sessions linked to telehzyt.com and enable multi-factor authentication on all Telegram accounts. Organizations should block the domain and its resolving IP (216.150.1.1) at the network perimeter, and monitor for indicators of compromise, including unusual login attempts or unauthorized access. Security teams are advised to review logs for connections to the domain or IP, particularly from endpoints that may have interacted with Telegram-related services during the active window. Given the future creation date, further investigation into the registrar’s role in facilitating potentially fraudulent domain registrations is recommended.