pravacomp-ddr[.]top

This domain is flagged for elevated-risk brand impersonation, specifically targeting Telegram users with fraudulent credential harvesting or scam distribution. Analysis indicates the domain was designed to mimic Telegram’s official infrastructure, likely to exploit user trust and distribute malicious content or collect sensitive information under false pretenses. The page title, "Купить права в Красноярске с внесением в реестр ГИБДД за 7 дней," suggests a localized scam operation unrelated to Telegram’s core services, further indicating deceptive intent. Infrastructure analysis reveals the domain pravacomp-ddr.top was registered on September 22, 2025, through Dynadot LLC and resolves to the IP address 45.91.202.37. It is currently offline but was previously detected by 3 out of 95 security vendors on VirusTotal. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by SSL Corp, a common provider for both legitimate and malicious domains, offering no inherent trust validation. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its resolving IP (45.91.202.37) at the network perimeter. Security teams should monitor for internal traffic attempting to access pravacomp-ddr.top or related subdomains, as this may indicate compromised endpoints or user engagement with the scam. User awareness training should emphasize verifying domain authenticity before interacting with Telegram-related links, particularly those promoting unrelated services. Additionally, organizations should review logs for connections to the registrar (Dynadot LLC) or the identified IP, as these may correlate with other malicious activity.