teleufdq[.]sbs

This domain, teleufdq.sbs, is currently under investigation for credential theft targeting users of the Telegram messaging platform. Analysis indicates the site impersonates the legitimate Messenger service, likely to harvest login credentials or other sensitive user data. The domain remains active and has not yet been widely detected by security vendors. Infrastructure analysis reveals the domain was registered on June 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 27.124.47.186 and presents an SSL certificate labeled as belonging to Telegram. As of the latest scan, the domain has not been flagged by any of the 95 vendors on VirusTotal, though its page title explicitly displays "Messenger," reinforcing the impersonation theme. No blocklist entries or trust score deviations have been recorded at this time. The domain remains operational, and users are advised to exercise caution. Immediate recommendations include blocking the domain and IP at the network level, monitoring for unusual authentication attempts, and educating users about credential theft tactics. Security teams should treat this domain as high-risk until further analysis confirms its legitimacy or malicious intent.