telegramaem[.]com

The domain telegramaem.com was registered on July 17, 2025 through P.A. Viet Nam Company Limited and resolves to the Amazon-owned IP address 216.150.1.1 (AS16509, United States). DNS is served by a mixed set of nameservers—ns1.dotvndns.vn and the Vercel pair ns1.vercel-dns.com/ns2.vercel-dns.com—suggesting a multi‑region hosting approach. The site presents a page title "Telegram官网 - 官方中文站点 | 下载、教程、Web登录", directly referencing Telegram and positioning itself as an official Chinese portal, which aligns with the classified brand‑impersonation threat type. TLS is provided by a DigiCert Global G2 RSA SHA256 certificate issued by DigiCert Inc, confirming a legitimate‑looking HTTPS endpoint. HTTP requests receive a 301 redirect, and the domain is currently listed as active. VirusTotal scans show 15 of 95 security vendors flagging the domain, and it appears on one public blocklist. PhishDestroy has already blocked the domain, indicating awareness within at least one anti‑phishing feed. While the page title confirms Telegram impersonation, no detailed content analysis is available, so the exact credential‑capture mechanisms, if any, remain unknown. Defenders should immediately add telegramaem.com and its resolving IP 216.150.1.1 to network blocklists, monitor for similar Vercel‑based DNS configurations, and ensure that email and web filtering rules flag any traffic to this domain. Ongoing intelligence collection should focus on retrieving the landing page content, observing any POST requests, and correlating user reports to gauge the campaign’s reach.