honeyman1[.]cc

The domain honeyman1.cc was observed delivering a brand‑impersonation campaign targeting Telegram. The site was registered on 15 June 2025 through the registrar Immaterialism and is currently taken offline. DNS resolution points to 172.66.0.70, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint at the time of capture. HTTP requests to the host returned a 409 Conflict status, a response often associated with misconfigured or intentionally blocked resources.

Infrastructure analysis shows the presence of Google Analytics and Cloudflare as the only detected technologies, suggesting the operators leveraged common web‑hosting services rather than bespoke malicious toolkits. Reputation signals are strongly negative. Gridinsoft assigned a trust score of 0 / 100, and two of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. The page title returned by the server is “Honeyman1.cc”, providing no additional context about the payload.

No Safe Browsing, Open Threat Exchange, or public evidence URLs were identified in the available data set. Given the combination of a recent registration, low trust rating, Cloudflare‑based hosting, a valid Google‑issued TLS certificate, and detection by multiple security vendors, the domain should be treated as a high‑confidence Telegram impersonation vector. Defenders are advised to add honeyman1.cc to inbound and outbound filtering rules, monitor DNS queries for the listed nameservers (1‑you.njalla.no, 2‑can.njalla.in, 3‑get.njalla.fo), and ensure that any user‑initiated connections to the domain are blocked. Continuous re‑evaluation is recommended in case the site re‑appears, as the current offline status may be temporary.