telemage[.]life

This domain, telemage.life, is identified as a phishing site specifically designed to impersonate WhatsApp, targeting users with fraudulent login pages to harvest credentials. The threat type is classified as credential phishing, with a focus on social engineering tactics to deceive victims into disclosing sensitive account information. As of the latest analysis, the domain is offline, though its infrastructure remains a potential risk for future malicious activity. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on April 11, 2026, and resolves to the IP address 45.76.215.177, hosted by Vultr Holdings, LLC in Japan. The SSL certificate is issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 hierarchy. Security vendor detections on VirusTotal indicate 17 of 95 engines flagged the domain as malicious, while it appears on one security blocklist. The page title explicitly mimics WhatsApp, reinforcing its impersonation theme. The domain’s current status is offline, but its prior activity and technical indicators warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP (45.76.215.177) at the network level. Security teams should review logs for connections to this IP or domain and alert affected users to reset credentials if interaction occurred. Proactive measures include updating endpoint protection rules to detect similar phishing infrastructure and educating users on recognizing impersonation attempts targeting messaging platforms.