teiegtm[.]shop

Analysis of www.teiegtm.shop, observed on July 24, 2026, indicates an elevated‑risk brand‑impersonation campaign targeting Telegram. The domain was registered on September 25, 2025 through Gname.com Pte. Ltd. and uses the authoritative nameservers a9.share‑dns.com and b9.share‑dns.net. DNS resolution points to the IPv4 address 172.245.67.31, which belongs to AS36352 (HostPapa) and is geolocated in the United States. The SSL certificate presented for the host resolves to 172.245.67.50, confirming that the same hosting provider is likely serving both HTTP and TLS services. The page title returned from the site is the Chinese phrase “进入首页”, which translates to “Enter Home Page”, but no further content has been captured because the service is currently offline.

Reputation signals are strongly negative. The domain appears on one security blocklist and is explicitly listed by PhishDestroy as a malicious entry. VirusTotal reports nine detections out of ninety‑five scanned vendors, reinforcing the suspicion of malicious activity. Gridinsoft assigns a trust score of 0 / 100, indicating a complete lack of confidence in the site’s legitimacy. The combination of brand impersonation, a low trust score, and multiple vendor detections meets the criteria for an elevated‑risk classification.

Uncertainty remains regarding the exact phishing kit or payload delivered, as the site’s content has not been archived. No evidence of additional infrastructure, such as supporting C2 hosts or related domains, is available in the current data set. Defenders should therefore treat www.teiegtm.shop as a confirmed malicious indicator. Recommended actions include adding the domain and its resolving IP address to network blocklists, monitoring for any future DNS changes, and correlating logs for traffic to the associated nameservers. Continuous threat‑intel feeds should be consulted for potential reuse of the hosting environment in other campaigns.