io-pay[.]shop

Analysis of the domain io-pay.shop shows a newly registered site (created 5 June 2026) that claims to offer services related to Telegram, as indicated by the page title containing the terms “Telegram业务 API接码”. The domain is registered through GNAME.COM PTE. LTD. and is hosted behind Cloudflare’s network (nameservers albert.ns.cloudflare.com and grannbo.ns.cloudflare.com, IP 188.114.97.3, United States). The site serves content over HTTPS with a certificate issued by Google Trust Services (WE1) and enforces HSTS. Detected front‑end technologies include Bootstrap, jQuery, and HTTP/3 support, alongside Cloudflare Browser Insights. The HTTP response returns status 200. The domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in two threat‑intel pulses, and VirusTotal reports four of ninety‑one scanners flagging it. Gridinsoft assigns a trust score of 0 / 100. The threat is classified as brand impersonation targeting Telegram, and the current status is active. Defenders should treat the domain as hostile: add it to URL filtering and DNS block lists, monitor for any related traffic, and consider sinkholing the IP range if feasible. Since the site’s internal content has not been examined, further investigation may be warranted to confirm any credential‑harvesting mechanisms, but existing indicators justify immediate preventative controls.