miyamiyamiya[.]pages[.]dev

This domain, miyamiyamiya.pages.dev, is actively engaged in brand impersonation targeting Telegram users. Analysis of the page title, "Sanko Miya," and domain structure indicates an attempt to mimic legitimate Telegram services, likely to harvest credentials or distribute malicious payloads. No explicit crypto drainer kit signatures were observed, but the domain exhibits characteristics consistent with phishing campaigns designed to exploit trust in the Telegram brand. Infrastructure analysis reveals the domain was registered on August 4, 2025, through Cloudflare, Inc., and resolves to the IP address 104.21.96.1, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, with no detections reported by Google Safe Browsing at the time of analysis. The domain remains active, posing a continued risk to users who may encounter it through phishing links or deceptive advertisements. Response actions should include blocking the domain at the network level, monitoring for related infrastructure (e.g., subdomains, associated IPs), and alerting users to the impersonation threat. The low detection rate (1/95) suggests evasion techniques may be in use, warranting further scrutiny of the domain's behavior and traffic patterns. Organizations are advised to treat this domain as high-risk and implement real-time filtering to prevent access.