tlcwhidbey[.]org

The domain www.tlcwhidbey.org was registered through GoDaddy.com, LLC on 21 February 2026 and is currently resolved to the Cloudflare‑owned address 104.21.68.232 (AS13335, United States). DNS resolution uses the Cloudflare nameservers celeste.ns.cloudflare.com and sevki.ns.cloudflare.com, and the site presents a Google Trust Services / WE1 SSL certificate, indicating HTTPS availability. HTTP requests return a 301 redirect, and infrastructure fingerprinting reveals a WordPress stack backed by MySQL and PHP, with AMP, LiveChat, Cloudflare Browser Insights, and HTTP/3 enabled. The page title retrieved from the host is "MAXWIN138: Link Situs Slot Gacor Toto Resmi Tembus Maxwin Hari Ini", which appears unrelated to the claimed impersonation of the Telegram brand. VirusTotal scans show that 2 of 93 security vendors flagged the domain, and AlienVault OTX lists it in one threat pulse. The domain is currently classified as a high‑risk, active brand‑impersonation campaign targeting Telegram users, and it has been blocked by PhishDestroy and appears on one external blocklist. Gridinsoft assigns a trust score of 0 / 100. Defenders should add www.tlcwhidbey.org to URL filtering and sink‑hole rules, monitor DNS queries for the associated Cloudflare IPs, and educate end‑users that any Telegram‑related login request originating from this domain is malicious. Further analysis of the site content is required to confirm the exact lure technique, but the observed infrastructure and detection history justify immediate preventative controls.