us22webzoom[.]us

This domain, us22webzoom.us, was identified as a brand impersonation threat targeting Telegram users. Analysis indicates the site was designed to mimic Telegram’s official branding, likely to deceive users into disclosing credentials, personal data, or installing malicious software. The domain’s infrastructure and content suggest a phishing campaign aimed at exploiting trust in the Telegram brand, potentially leading to account compromise or unauthorized access to sensitive information.

Technical evidence confirms the domain’s malicious nature. The domain was registered through Dynadot LLC on December 18, 2025, and resolves to the IP address 87.236.16.18, hosted by Beget LLC in Russia (AS198610). VirusTotal detections show 12 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate, issued by Let’s Encrypt (R13), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. The page title, 'The new site has been successfully created and is ready to work,' suggests a placeholder or recently deployed phishing page.

Users who visited us22webzoom.us should take immediate action to mitigate potential risks. If credentials or personal information were entered, reset passwords for Telegram and any other accounts using the same credentials. Scan the device for malware using updated security tools, as phishing sites may deliver malicious payloads. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. Organizations should update blocklists to include this domain and its associated IP address (87.236.16.18) to prevent further exposure. Given the domain’s current offline status, continued monitoring of related infrastructure is recommended to detect any resurgence of activity.