Is tg-verification.online safe?
http://tg-verification.online/
Coveragepartial2 of 4 applicable core capabilities
tg-verification.online is a flagged Telegram-branded phishing page that shows only "Loading..." while it is built to harvest credentials
This is a young, anonymous domain (registered 2026-05-21, about 150 days old) that presents nothing but a "Loading..." screen. Independent threat research identifies it as a generic phishing site that uses a fake loading page to deceive visitors, most likely to harvest Telegram login credentials or personal information, and seven independent antivirus families flag it as adverse. The site's own contact and policy pages were never read in full, so there is no operator disclosure to weigh against the phishing finding. A valid TLS certificate and a clean the browser threat feed result only mean no warning was returned at scan time; they do not make a credential-harvesting page safe. The combination of an active phishing identification, multi-vendor detections, a brand-new anonymous domain and a deliberately empty loading screen places this in the Dangerous band.
Be the first to review tg-verification.online
Lost money to tg-verification.online? Warn others
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
This is a young, anonymous domain (registered 2026-05-21, about 150 days old) that presents nothing but a "Loading..." screen. Independent threat research identifies it as a generic phishing site that uses a fake loading page to deceive visitors, most likely to harvest Telegram login credentials or personal information, and seven independent antivirus families flag it as adverse. The site's own contact and policy pages were never read in full, so there is no operator disclosure to weigh against the phishing finding. A valid TLS certificate and a clean the browser threat feed result only mean no warning was returned at scan time; they do not make a credential-harvesting page safe. The combination of an active phishing identification, multi-vendor detections, a brand-new anonymous domain and a deliberately empty loading screen places this in the Dangerous band.
What the evidence shows
Independent threat research states that tg-verification.online has been identified as a generic phishing threat, remains active, and carries a high risk level. The same source describes the mechanism directly: the site attempts to deceive visitors by presenting a fake loading page, likely to harvest login credentials or personal information. The domain name itself mimics a Telegram verification flow, which is the kind of branding a credential-harvesting page would use to make a fake login prompt look routine.
That finding is corroborated by saved antivirus evidence: seven independent antivirus families returned an adverse result, naming alphaMountain.ai, BitDefender and ESET among the detecting engines. This is a saved observation rather than a fresh submission, so the exact timing should be treated with some caution, but the detection itself is real and consistent with the phishing identification.
Technical checks versus operator risk
Two technical checks came back clean: the browser threat feed returned no threat warning, and the saved TLS check found a valid encrypted connection. Neither is a safety signal for this kind of site. A phishing page can sit behind a perfectly valid certificate, and a clean Safe Browsing result simply means no warning was returned at the moment of the check, not that the page is trustworthy.
The operator side is where the risk concentrates. The registrable domain is only about 150 days old, and registration records show it was created on 2026-05-21. The site's own contact details were not reviewed because the page text was not read in full, so there is no disclosed operator, company or contact information to weigh against the phishing finding. A brand-new, anonymous domain that exists only to show a loading screen is exactly the profile of a disposable credential-harvesting page.
Why the score is 12
7 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
10/ 91
detectionsSaved analysis from September 22, 2026 - stale
10 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 8
- Suspicious
- 2
- Total
- 91
| Engine | Finding |
|---|---|
| alphaMountain.aiMalicious | phishing |
| BitDefenderMalicious | phishing |
| ESETMalicious | phishing |
| Forcepoint ThreatSeekerMalicious | phishing |
| G-DataMalicious | phishing |
| LevelBlueMalicious | phishing |
| LionicMalicious | phishing |
| VIPREMalicious | phishing |
| FortinetSuspicious | spam |
| GridinsoftSuspicious | suspicious |
All 91 engine results
- alphaMountain.ai - phishing - Malicious
- BitDefender - phishing - Malicious
- ESET - phishing - Malicious
- Forcepoint ThreatSeeker - phishing - Malicious
- G-Data - phishing - Malicious
- LevelBlue - phishing - Malicious
- Lionic - phishing - Malicious
- VIPRE - phishing - Malicious
- Fortinet - spam - Suspicious
- Gridinsoft - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESTsecurity - Clean
- Fortra - Unrated
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Unrated
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
03 · Investigation Story
Investigation story
What the site claims
Loading
What we observed
The page content was captured and checked alongside 60 antivirus results.
What independent research found
2 external findings were saved and compared with the page evidence.
What remains unverified
2 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Phishing & Impersonation
Service and business model
Login Portal
Observed behavior
Evidence behind this classification
- 01One public warning on a scam-warning or security site: "The domain tg-verification.online has been identified as a generic phishing threat and remains active with a high risk level. This site attempts to deceive…"
- 027 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- 03The only page content observed is a "Loading..." message, consistent with a landing page built to deceive rather than to serve visitors.
What this means for you
What a visitor actually encounters
A visitor arriving at tg-verification.online sees a single "Loading..." message and nothing else. There is no visible content, no explanation of what the site is, and no legitimate service being offered.
How the observed mechanism works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
According to the threat research, that loading screen is the deception: the page is designed to look like a Telegram verification step so that a visitor who waits and then enters credentials or personal information hands them to the attacker. Anyone who entered a Telegram login, phone number or code on this page should treat those credentials as compromised.
Do not visit tg-verification.online and do not enter any Telegram login, phone number, password or verification code on it. If you already did, change your Telegram password, terminate active sessions from Telegram's settings, and enable two-step verification. Treat any message that pointed you to this domain as a phishing attempt and report it inside Telegram.
Web research findings
Independent findings for tg-verification.online, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
- PhishDestroyopen
"The domain tg-verification.online has been identified as a generic phishing threat and remains active with a high risk level. This site attempts to deceive visitors by presenting a fake loading page, likely to harvest login credentials or personal information."
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domaintg-verification.online
- Redirects totg-verification.online
- Hosted byShinomiya-Hosting
- Referencesfonts.googleapis.com · fonts.gstatic.com
Domain Timeline
- May 21, 2026Domain registered
First appeared in WHOIS records — 5 months old when this review was saved.
- Oct 19, 2026Saved security review — Rated Dangerous
The completed checks from this saved scan are detailed above.
tg-verification.online was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
Domain & Encryption
Redirect Chain
- 1308http://tg-verification.online/
- 2200https://tg-verification.online/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentpartial
- Analysiscomplete
- Visual evidenceunavailable
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
7 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing. · The only page content observed is a "Loading..." message, consistent with a landing page built to deceive rather than to serve visitors.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
One public warning on a scam-warning or security site: "The domain tg-verification.online has been identified as a generic phishing threat and remains active with a high risk level. This site attempts to deceive…"
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 10 of 91 engines flagged | Limited | Adverse | stale fallback · analysed Sep 22, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 19, 2026 |
| Page content | Page fetched · HTTP 200 | Limited | No saved finding | this scan · Oct 19, 2026 |
| Visual evidence | The saved page capture was not reliable enough to use | Unavailable | No saved finding | Not available |
| Independent research | 2 independent findings were saved | Completed | Adverse | this scan · Oct 19, 2026 |
- Antivirus
- Result10 of 91 engines flagged
- CompletionLimited
- FindingAdverse
- Freshnessstale fallback · analysed Sep 22, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionLimited
- FindingNo saved finding
- Freshnessthis scan · Oct 19, 2026
- Visual evidence
- ResultThe saved page capture was not reliable enough to use
- CompletionUnavailable
- FindingNo saved finding
- FreshnessNot available
- Independent research
- Result2 independent findings were saved
- CompletionCompleted
- FindingAdverse
- Freshnessthis scan · Oct 19, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is tg-verification.online a scam or a legit website?
Is tg-verification.online safe to use?
What should I do if I already gave my details to tg-verification.online?
Can I get my money back from tg-verification.online?
Did tg-verification.online steal my password or personal information?
How do I report tg-verification.online?
Why does tg-verification.online look legitimate if it's a scam?
Has tg-verification.online been flagged by antivirus engines?
Is tg-verification.online on any phishing or malware blacklists?
How old is the tg-verification.online domain?
Where is tg-verification.online hosted?
How often is the tg-verification.online report updated?
08 · Final Verdict
Final verdict
tg-verification.online is a flagged Telegram-branded phishing page that shows only "Loading..." while it is built to harvest credentials
The written conclusion remains part of the saved report.
This is a young, anonymous domain (registered 2026-05-21, about 150 days old) that presents nothing but a "Loading..." screen. Independent threat research identifies it as a generic phishing site that uses a fake loading page to deceive visitors, most likely to harvest Telegram login credentials or personal information, and seven independent antivirus families flag it as adverse. The site's own contact and policy pages were never read in full, so there is no operator disclosure to weigh against the phishing finding. A valid TLS certificate and a clean the browser threat feed result only mean no warning was returned at scan time; they do not make a credential-harvesting page safe. The combination of an active phishing identification, multi-vendor detections, a brand-new anonymous domain and a deliberately empty loading screen places this in the Dangerous band.
09 · Community