web[.]tealagram[.]icu

This domain is flagged as an elevated-risk phishing infrastructure specifically designed to mimic Telegram login interfaces. Analysis indicates it operates as a credential harvesting platform, likely targeting users through deceptive messaging or social engineering tactics that redirect victims to fake authentication portals. The domain poses a direct threat to account security, with potential secondary risks including unauthorized access to linked services or further phishing distribution via compromised accounts. Infrastructure analysis reveals the following technical indicators: the domain web.tealagram.icu resolves to IP address 188.114.96.3 and was registered on March 28, 2026, through Gname.com Pte. Ltd. Security validation shows 15 out of 95 vendors on VirusTotal flagging the domain as malicious, while it appears on at least one active security blocklist. The domain is currently offline, though its prior operational status was confirmed by its inclusion in the PhishDestroy blocklist. The creation date suggests recent deployment, a common characteristic of short-lived phishing campaigns designed to evade detection. Mitigation requires immediate action from both end users and network administrators. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly if identical passwords were reused across services. Multi-factor authentication should be enabled where available to mitigate unauthorized access. Network-level protections should include blocking the domain and its associated IP (188.114.96.3) at perimeter defenses, while security teams should monitor for indicators of compromise such as unexpected login attempts or anomalous outbound connections to the resolved IP. Given the domain's offline status, continued vigilance is advised as threat actors may redeploy similar infrastructure under new domains.