telegram[.]autentifikator[.]ru

Analysis of telegram.autentifikator.ru indicates a phishing domain targeting Telegram users, currently offline as of July 25, 2026. The domain was registered on March 24, 2026, through REGRU-RU and resolves to the IP address 141.98.190.101, hosted by UFO Hosting LLC in Russia. The site employed a Let's Encrypt SSL certificate and was served via Nginx with HSTS enabled, suggesting an attempt to appear legitimate. The page title displayed 'Telegram,' aligning with the likely intent to mimic the official Telegram login interface, though no direct evidence of the site's visual content or functionality is available for confirmation.

Security vendors flagged this domain, with 14 of 94 engines on VirusTotal detecting it as malicious. It also appears on at least one security blocklist. The domain's nameservers (dns1.link-host.net and dns2.link-host.net) and MX records (mail.telegram.autentifikator.ru with priorities 10 and 20) further indicate an infrastructure setup typical of phishing operations, where email handling is configured to support credential harvesting or follow-up attacks. Defenders should treat this domain as part of a broader phishing campaign targeting Telegram credentials.

The use of a subdomain (autentifikator) and the Telegram brand in the domain name suggests an attempt to deceive users into believing they are accessing a legitimate authentication portal. While the domain is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis, and any residual DNS resolutions or cached pages should be monitored. Network-level blocks on the IP (141.98.190.101) and associated nameservers may prevent future abuse from the same infrastructure. Given the domain's registration date and detection timeline, defenders should also check for related domains registered through REGRU-RU or hosted on UFO Hosting LLC's network, as these may share infrastructure or operational ties.