zerophish / console
Register Sign in
URL THREAT INTELLIGENCE · v0.5.0 · OPERATIONAL

The full anatomy of a phishing site,
one URL at a time.

ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.

scan
100 scans / day · free · typical scan 2–4 s ·
try
Result scan 510b6f79
Scan another →
CACHED Showing previous scan from 86 d ago. Click Reanalyze to run a fresh scan.
SAFE · HIGH CONFIDENCE

No phishing signals detected

brand Telegram scan id 510b6f79 duration 14.95s signals 1 failing / 12
Risk score 0.05
5 / 100 · Low risk
Tags
URL anatomy t.me
https :// t . me /+SBSrNqF5wm0zZGJk
flagged registered domain path protocol / query
Indicators of compromise 5 · click any row to copy
URL hxxps://t[.]me/+SBSrNqF5wm0zZGJk
Host t[.]me
Brand Telegram
Screenshot https://cdn.zerophish.ai/47145d46-f57d-436f-ac75-57152cddef66.jpg
Scan ID 510b6f79-9ae0-404a-9d11-c9687fae6014
Detection signals 1 fail · 0 warn · 6 pass
Brand typo-squat detected
No similar legitimate brand within edit-distance 2
critical
Domain age
Awaiting analysis
high
Threat intel blocklists
Awaiting analysis
critical
Credential collection form
No credential collection form on visible content
high
×
Visual similarity to known brand
100% structural similarity to Telegram
high
Favicon impersonation
Favicon matches the registered owner
medium
SSL certificate
Served over HTTPS · valid TLS certificate
low
DNS reputation
Awaiting analysis
medium
showing 8 of 12 ·
Captured page from scan
Captured page
screenshot · captured at scan live page render
Brand impersonation visual + DOM analysis
T
Telegram
100%
Technical profile resolved at scan time
Host t.me
Registered domain t.me
Scheme https
Content length 50395 B
HTTP 200 · text/html
JARM 0d30d30d30d30d38c28c28c28c26024ae70465a3e04aec8240757ef3ab5c8c
Redirect hops 1
Analyst summary AI-generated
Initial scan heuristic + LLM

Verdict: Legitimate (Telegram invite/join page)

What the page presents itself as

The page is a Telegram “join” landing page for a public invite link: “Telegram: Join Group Chat” and it shows “You are invited to the channel Badda Bing 🧘. Click above to join.” The main call-to-action button is “Join Channel.”

Suspicious elements checked (and none found)

  • No credential collection form: In the provided HTML/OCR, there is no login, password, or payment/SSO form—only a join action.
  • No fake security warnings / account alerts: There are no messages like “account compromised,” “verify now,” or similar urgency/anti-security claims.
  • No mismatched branding: The URL is t.me and the page content/structure matches Telegram’s standard invite/join page layout (e.g., tgme_page_* classes, “You are invited…” wording, and the join link uses the tg://join?invite=... scheme).
  • No suspicious redirects in the join flow: The join button uses tg://join?invite=SBSrNqF5wm0zZGJk (Telegram deep-link), not a third-party domain.

URL vs. brand/domain relationship

  • Identified brand: Telegram.
  • Domain alignment: The URL is https://t.me/+SBSrNqF5wm0zZGJk, which is consistent with Telegram invite links. The HTML also contains a Telegram download link (telegram.org) and Telegram deep-link join (tg://join?invite=...). This alignment strongly supports legitimacy.

Conclusion

This page is best explained as a Telegram channel/group invite page. While the channel description includes adult/“confessions” and “premium or paid promotion” language (which could be used for scams in other contexts), there is no technical phishing pattern present in the provided content—specifically no credential-harvesting form, no impersonation mismatch, and no fake security/urgency prompts.