report-telegram[.]org

This domain, report-telegram.org, was registered on July 15, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and is presently active. The site resolves to 172.67.139.53, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution is provided by carter.ns.cloudflare.com and frida.ns.cloudflare.com, both Cloudflare nameservers. The web server presents a valid SSL certificate issued by Google Trust Services under the WE1 profile, and the connection negotiates HTTP/3 over Cloudflare’s edge network. Page inspection returns an HTTP 200 response with the title “Home”.

Automated fingerprinting identifies Bootstrap as the front‑end framework and confirms the presence of Cloudflare services. The content is classified as a social media phishing campaign that impersonates the Telegram brand. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy feed. VirusTotal analysis shows that one out of ninety‑five scanned vendors flagged the domain, indicating at least one detection for malicious behavior. No additional public reputation signals are present.

While the observed infrastructure aligns with typical phishing hosting patterns—rapid domain creation, use of Cloudflare’s CDN, and a generic home page title—no further details on the payload, credential‑capture mechanisms, or redirect behavior have been disclosed. Consequently, the exact tactics employed by the actors remain uncertain. Defenders should add report-telegram.org to URL filtering and endpoint allow‑list exclusion rules, enforce TLS inspection to observe any downstream redirects, and monitor for credential‑submission attempts targeting Telegram accounts. Given the active status and confirmed brand impersonation, organizations are advised to treat traffic to this host as high‑risk and block it at the network perimeter.