gmrk[.]pro

Analysis of the domain gmrk.pro indicates an active brand‑impersonation campaign targeting Telegram users. The site was registered on June 25 2025 through NiceNIC International Group Co., Limited and is served by Cloudflare’s network (AS13335) from the IP address 172.67.165.13 located in the United States. DNS resolution uses the Cloudflare nameservers deb.ns.cloudflare.com and lochlan.ns.cloudflare.com, confirming the reliance on Cloudflare’s edge services. An HTTPS connection is presented with a certificate issued by Google Trust Services under the WE1 branch, and the server supports HTTP/3, suggesting a modern delivery stack. Front‑end assets include particles.js and resources from jsDelivr, typical of generic web‑toolkits.

The HTTP response returns status 200 and the page title is “Гримерка”, a Cyrillic term unrelated to the advertised brand. The domain is classified as a “Brand Impersonation” scam and explicitly claims to impersonate Telegram. VirusTotal has recorded four detections out of ninety‑three scanning engines, and the domain appears on a single active blocklist maintained by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. Current intelligence does not reveal the exact phishing vector nor any associated malware payloads; the content of the landing page has not been publicly disclosed.

However, the combination of a low trust score, multiple vendor detections, and inclusion on a phishing blocklist warrants immediate mitigation. Defenders should add the IPv4 address 172.67.165.13 to deny‑list rules, block the domain gmrk.pro at DNS and proxy layers, and monitor for similar Cloudflare‑hosted infrastructures that employ the same nameserver pair. Continuous re‑scanning with multi‑vendor platforms is advised to capture any evolution in detection rates.