gazprombank-momentum[.]ru

Analysis of gazprombank-momentum.ru shows a high‑risk brand‑impersonation infrastructure targeting Telegram users. The domain was registered on 2023-03-06 through BEGET‑RU and resolves to IP 45.130.41.47, which is advertised as belonging to AS198610 Beget LLC in Russia. The site presents an HTTP 200 response with the page title "This domain is not linked to any directory on the server!" and serves a Let’s Encrypt R12 certificate, indicating a valid TLS endpoint. DNS is hosted on six Beget name servers (ns1.beget.com, ns1.beget.pro, ns1.beget.ru, ns2.beget.com, ns2.beget.pro, ns2.beget.r). VirusTotal scans have flagged the domain by five of ninety‑five security vendors, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one public blocklist and is actively blocked by PhishDestroy. The declared scam type is banking phishing, and the brand target is Telegram, suggesting that any credential‑harvesting pages would likely masquerade as Telegram login or payment prompts. Defenders should add the domain and its resolving IP to outbound‑filter lists, monitor for related DNS queries, and enforce TLS inspection to detect any credential exfiltration attempts. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to the Beget hosting environment.