teiegtm[.]click

Analysis of www.teiegtm.click, observed as offline at the time of review (24 July 2026), shows a classic brand‑impersonation campaign targeting Telegram users. The domain was registered on 25 September 2025 via Gname.com Pte. Ltd. and is hosted on a HostPapa infrastructure (AS36352) located in the United States, resolving to 172.245.67.31. The associated TLS certificate presents a mismatched IP of 172.245.67.50, indicating a possible misconfiguration or deliberate obfuscation. Nameserver records point to a7.share-dns.com and b7.share-dns.net, which are commonly used by short‑lived phishing sites.

Gridinsoft assigns a trust score of 0 / 100, and the site appears on one external blocklist. VirusTotal scans have flagged the domain by 10 of 95 security vendors, confirming malicious intent. The page title returned from the HTTP response is the Chinese phrase “进入首页”, which does not provide functional context but demonstrates the presence of a hosted landing page. The domain is listed as blocked by PhishDestroy, reinforcing its classification as a brand‑impersonation threat.

No additional behavioural data such as login pages, payload delivery, or credential harvesting mechanisms have been captured, leaving the exact attack vector uncertain. Defenders should add www.teiegtm.click to URL filtering policies, deny traffic to its IP address, and monitor for any future re‑registration or similar domains using the same registrar or nameserver pattern. Continuous observation of the associated IP range and TLS fingerprint is recommended to detect potential reuse in subsequent campaigns.