photonstars[.]com

Analysis of photonstars.com indicates infrastructure linked to brand impersonation targeting Telegram users, with evidence suggesting a focus on distributing digital goods under false pretenses. The domain, registered on February 23, 2026, through NiceNIC International Group Co., Limited, resolves to IP address 104.21.40.48, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data transmission. Nameservers marge.ns.cloudflare.com and michael.ns.cloudflare.com further confirm Cloudflare's role in the domain's DNS configuration.

The page title, 'Digital Goods Catalog Page,' aligns with known Telegram scam patterns, where threat actors impersonate legitimate platforms to offer fraudulent digital products or services. Two of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist, corroborating its association with abusive activity. Gridinsoft assigned a trust score of 0/100, reinforcing the elevated risk classification. The domain was blocked by PhishDestroy, a specialized anti-phishing service, and is currently offline as of the report date.

Defenders should treat this domain as part of a Telegram-branded phishing campaign, particularly given the explicit 'brand impersonation' classification in available threat intelligence. The absence of an SSL certificate and reliance on Cloudflare infrastructure are consistent with low-effort but scalable phishing operations. While the exact content of the site remains unanalyzed, the combination of registration details, hosting provider, and detection by security vendors justifies blocking or monitoring the domain in enterprise environments. Further investigation into associated IP ranges (104.21.0.0/16) and Cloudflare nameservers may reveal additional linked infrastructure.