# telegram-kr.com.cn: Korean Telegram Download Guide Page | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/telegram-kr.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/telegram-kr.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: Last known active
- First observed by PhishDestroy: 2026-11-12 21:25:23 UTC
- Selected availability observation: 2026-11-12T21:25:23Z
- Stored record updated: 2026-11-12 21:59:25 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: checked_clean

## Stored labels and detections

- Automated brand label (collector metadata; not a confirmed impersonation finding): Telegram

## Stored infrastructure

- Observed IP address: 152.32.139.249
- Registrar in stored WHOIS data: 广州翼优信息科技有限公司
- Last stored HTTP status: 200 (observed: 2026-11-12T21:25:23Z)
- Registration date in stored WHOIS data: 2026-10-27 04:02:04 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1d1a4-cda1-7242-ba55-00234ba472d7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/telegram-kr.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.telegram-kr.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://telegram-kr.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy records telegram-kr.com.cn as a Korean-language page presenting Telegram download and installation guidance for Android, iPhone, Windows and Mac.

On 2026-11-12, telegram-kr.com.cn displayed a Korean-language page titled "TELEGRAM DOWNLOAD GUIDE" offering Telegram download and installation instructions for Android, iPhone, Windows PC, Mac and Linux. The page presents two prominent buttons, one labeled for going directly to an official download and another for device-specific downloads, alongside a note stating the page is not Telegram or an existing official site.

The stored VirusTotal domain result reports 4 detections out of 92 engines. CRDF reported "malicious"; LevelBlue reported "phishing".
Package revision: c36bf769ac362366eebc9679a47cbb7fb08110a4e154b18a3159aa961bba663e
Text generated (not scan time): 2026-11-12 22:59:24
Reviewed evidence snapshot: {"domain":"telegram-kr.com.cn","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"telegram-kr.com.cn","final_host":"telegram-kr.com.cn","redirects":[{"to":"https://telegram-kr.com.cn/","from":"http://telegram-kr.com.cn/","status":307}],"captured_at":"2026-11-12T21:23:27.919000Z","uuid":"01a1d1a4-cda1-7242-ba55-00234ba472d7","report_url":"https://urlscan.io/result/01a1d1a4-cda1-7242-ba55-00234ba472d7/","sha256":"ed08daf507f606caac62d8735d5c2f2fa534decb0db5cc5a0b6a6b599ca82cb5","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","virustotal":{"scope":"domain","detections":4,"engines":92,"malicious":3,"suspicious":1,"analysis_date":"2026-11-12","retrieved_date":"2026-11-12","vendor_labels":{"CRDF":"malicious","LevelBlue":"phishing","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"flagging_vendors":["CRDF","LevelBlue","Gridinsoft","alphaMountain.ai"]},"virustotal_public_summary":"The stored VirusTotal domain result reports 4 detections out of 92 engines. CRDF reported \"malicious\"; LevelBlue reported \"phishing\".","page_paragraph_target_characters":545}
Source facts (timestamps as stored): {"record_id":1948275,"first_recorded_at":"2026-11-12 22:25:23","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":4,"denominator":92,"malicious":3,"suspicious":1,"vendors":{"CRDF":"malicious","LevelBlue":"phishing","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"observed_at":"2026-11-12T21:20:03Z","checked_at":null,"fetched_at":"2026-11-12T21:57:42Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":4,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","CRDF","Gridinsoft","LevelBlue"],"observed_at":"2026-11-12 21:20:03","checked_at":"2026-11-12 22:57:42","fetched_at":"2026-11-12 21:57:43","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","LevelBlue":"phishing","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"vendor_names":["CRDF","LevelBlue","Gridinsoft","alphaMountain.ai"],"stats":{"timeout":0,"harmless":54,"malicious":3,"suspicious":1,"undetected":34}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-12 22:57:53"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":null},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1948275,"scope":"checked_url","observed_at":"2026-11-12T21:25:23Z","http_status":200,"http_observed_at":"2026-11-12T21:25:23Z","stored_http_code":200,"stored_http_observed_at":"2026-11-12T21:25:23Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}}

## Stored page captures

- URLScan · 2026-11-12: https://screenshots.phishdestroy.io/us/01a1d1a4-cda1-7242-ba55-00234ba472d7.png
  Captured: 2026-11-12 21:23:27 UTC
  Source report: https://urlscan.io/result/01a1d1a4-cda1-7242-ba55-00234ba472d7/
  SHA-256: ed08daf507f606caac62d8735d5c2f2fa534decb0db5cc5a0b6a6b599ca82cb5
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c76d767a-ffca-479d-9d5a-0d5e123ec165.png
  Source report: https://radar.cloudflare.com/scan/c76d767a-ffca-479d-9d5a-0d5e123ec165
  SHA-256: 88298f9361179eef8a594ad549841eff3d405249b6f6e64830990796bcc98934
- URLQuery: https://screenshots.phishdestroy.io/uq/dd4e788c-e937-4ba2-a4b0-83e671133aeb.png
  Source report: https://urlquery.net/report/dd4e788c-e937-4ba2-a4b0-83e671133aeb
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-11-12T21:27:20Z",
        "uuid": "01a1d1a4-cda1-7242-ba55-00234ba472d7",
        "scanned_at": "2026-11-12T21:23:27Z",
        "final_url": "https://telegram-kr.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://telegram-kr.com.cn/",
                "from": "http://telegram-kr.com.cn/",
                "status": 307
            }
        ],
        "ip": "152.32.139.249",
        "ips": [
            "152.32.139.249"
        ],
        "asns": [
            "135377"
        ],
        "countries": [
            "KR"
        ],
        "link_domains": [
            "telegram.org",
            "apps.apple.com",
            "desktop.telegram.org",
            "macos.telegram.org",
            "web.telegram.org"
        ],
        "doc_hash": "951ae68cb141452c7a6dfcfabf73f744d0667fc9696b430385c6e1182a68d6ee",
        "tls": {
            "san": [
                "telegram-kr.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "LiteSSL RSA CA 2025",
            "subject": "telegram-kr.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-24T19:59:59Z",
            "valid_from": "2026-10-26T20:00:00Z"
        },
        "domain_age_days": 16,
        "apex_age_days": 16,
        "tls_age_days": 17,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-2aab354"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "telegram"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Telegram"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-11-12T21:57:42Z",
        "analysis_at": "2026-11-12T21:20:03Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-10-26T21:33:34Z",
        "dns": [
            {
                "ttl": 1,
                "type": "A",
                "value": "152.32.139.249"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.jmdns.com",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.julydns.com"
            }
        ],
        "dns_at": "2026-11-12T21:20:25Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "telegram-kr.com.cn"
            ],
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "serial": "1fa9fd8a08a14e53e5d8b90f3c73e3bda4fadf2f",
            "sha256": "c8929cce3160d4ab27a47203fb5dbe002094bf70c4d15c040580cba8c8f7b982",
            "subject": "telegram-kr.com.cn",
            "valid_to": "2027-01-24T19:59:59Z",
            "valid_from": "2026-10-26T20:00:00Z",
            "observed_at": "2026-11-12T21:20:25Z"
        },
        "whois": {
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.onclouddns.com",
                "ns2.onclouddns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-11-12T22:06:15Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-11-12T21:26:43Z",
            "first": "2026-10-27T04:31:22Z",
            "changes": 0,
            "days_archived": 2,
            "scans_per_day": 0.06,
            "avg_page_bytes": 6083
        },
        "social_tags": {
            "ogUrl": "https://telegram-kr.com.cn",
            "title": "텔레그램 다운로드 | PC·모바일 공식 설치 및 사용 방법",
            "ogType": "website",
            "robots": "index,follow,max-image-preview:large",
            "ogTitle": "텔레그램 다운로드 | 공식 설치 가이드",
            "keywords": "텔레그램 다운로드, 텔레그램 설치, 텔레그램 PC 다운로드, 텔레그램 모바일 다운로드, 텔레그램 웹, Telegram Download",
            "ogSiteName": "텔레그램 다운로드 가이드",
            "themeColor": "#168de2",
            "description": "텔레그램 다운로드 방법을 한국어로 안내합니다. 안드로이드, 아이폰, Windows PC, Mac 버전의 공식 다운로드 링크와 설치 방법, 텔레그램 웹 사용법을 확인하세요.",
            "canonicalUrl": "https://telegram-kr.com.cn",
            "ogDescription": "PC와 모바일에서 텔레그램을 다운로드하고 설치하는 방법을 알아보세요."
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 424,
                "tls": 276,
                "wait": 510,
                "connect": 302,
                "download": 0
            },
            "response_ms": 1512
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443,
                8888
            ]
        },
        "carbon": {
            "bytes": 16568,
            "co2_grams": 0.0006,
            "cleaner_than": 61
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.251",
                    "host": "ns2.julydns.com"
                },
                {
                    "ip": "162.159.48.223",
                    "host": "ns1.julydns.com"
                }
            ],
            "zone": "telegram-kr.com.cn"
        },
        "location": {
            "ip": "152.32.139.249",
            "asn": "135377",
            "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
            "city": "Seoul",
            "country": "KR"
        },
        "ssl": {
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "subject": "telegram-kr.com.cn"
        },
        "dns": {
            "A": [
                "152.32.139.249"
            ],
            "NS": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ],
            "SOA": "{\"nsname\": \"ns1.julydns.com\", \"hostmaster\": \"master.jmdns.com\", \"serial\": 1793049189, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "152.32.139.249",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://telegram-kr.com.cn"
            ]
        },
        "linked_pages": {
            "external": [
                "https://telegram.org/apps/download",
                "https://desktop.telegram.org/",
                "https://telegram.org/dl/android",
                "https://apps.apple.com/app/telegram-messenger/id686449807",
                "https://macos.telegram.org/",
                "https://web.telegram.org/",
                "https://telegram.org/"
            ],
            "external_count": 7,
            "internal_count": 5
        },
        "whois": {
            "registrar": "广州翼优信息科技有限公司",
            "created": "2026-10-27T04:02:04Z",
            "expires": "2027-10-27T03:02:04Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.onclouddns.com",
                "ns2.onclouddns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```
Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a1d1a4-cda1-7242-ba55-00234ba472d7.png","source":"URLScan","report_url":"https://urlscan.io/result/01a1d1a4-cda1-7242-ba55-00234ba472d7/","captured_at":"2026-11-12T21:23:27Z","sha256":"ed08daf507f606caac62d8735d5c2f2fa534decb0db5cc5a0b6a6b599ca82cb5","model_image_sha256":"5ad074fb995041eea5f3798133a281f97d352e0877d62eabae61fba418157977","available":true,"content_status":null}

## Complete dated records
Availability observations: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=availability&format=json
Source observation history: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=detections&format=json
PhishStats records: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=phishstats&format=json
Sent report records: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=sent_reports&format=json
Report history: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=report_history&format=json
Repeat report records: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=rereports&format=json
Follow-up records: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=followups&format=json
Content observations: https://phishdestroy.io/domain/telegram-kr.com.cn/records.json?source=content&format=json

## Dated availability observation
Latest stored reachability observation
```json
{
    "state": "alive",
    "label_key": "availability.active",
    "detail_key": "detail.latest_reachability",
    "params": [],
    "source": "current_http_probe",
    "record_id": 1948275,
    "scope": "checked_url",
    "observed_at": "2026-11-12T21:25:23Z",
    "http_status": 200,
    "http_observed_at": "2026-11-12T21:25:23Z",
    "stored_http_code": 200,
    "stored_http_observed_at": "2026-11-12T21:25:23Z",
    "legacy_site_status": "alive",
    "supports_outcome_badge": false,
    "content_classification": "unknown",
    "content_classification_at": null,
    "registration_state": "unknown",
    "policy": "20261102-dated-availability-v2"
}
```