teleivmf[.]sbs

This domain, teleivmf.sbs, is flagged as a credential theft operation specifically designed to impersonate Telegram, a widely used messaging platform. Analysis indicates the site employs deceptive login prompts to harvest user credentials, likely targeting unsuspecting victims through phishing campaigns. No direct evidence of a crypto drainer kit was observed, but the Telegram-branded SSL certificate and page structure strongly suggest a credential harvesting focus. Infrastructure analysis reveals the domain was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 216.150.1.1, a host with no prior association with legitimate Telegram services. VirusTotal detection rates show 15 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist, and its SSL certificate is explicitly tied to Telegram, reinforcing the impersonation theme. The page title, 'Loading...,' suggests an attempt to mimic a legitimate service while delaying content rendering to evade automated detection. As of the latest assessment, teleivmf.sbs has been taken offline, reducing immediate exposure risk. However, the infrastructure remains registered until 2026, leaving open the possibility of reactivation or reuse. Organizations are advised to block the domain and associated IP at the perimeter, while users should verify SSL certificates directly through Telegram’s official channels. Continuous monitoring of related domains registered under the same registrar is recommended due to the elevated risk of recurring threats from this actor.