promvda[.]alertsbotsg[.]online

Analysis of promvda.alertsbotsg.online indicates a confirmed brand impersonation campaign targeting Telegram users. The domain, registered on February 21, 2026, resolves to IP 149.154.167.99, which is hosted on AS62041 (Telegram Messenger Inc) in the Netherlands. This infrastructure alignment with legitimate Telegram services increases the risk of deception, as victims may perceive the site as authentic. The page title, 'Telegram: Contact @Promvda_bot,' directly references a Telegram bot, reinforcing the impersonation of official Telegram communication channels.

Technical indicators show limited but actionable detection: one security vendor on VirusTotal flags the domain, and it appears on one security blocklist (PhishDestroy). The domain currently returns an offline status, suggesting takedown or voluntary suspension, though historical activity cannot be ruled out. The SSL certificate, issued by Go Daddy Secure Certificate Authority - G2, provides no inherent malicious signal but does not guarantee legitimacy. Gridinsoft assigns a trust score of 0/100, consistent with high-risk domains.

Defenders should treat this domain as a confirmed phishing resource due to its explicit brand impersonation, Telegram-specific page title, and hosting on infrastructure associated with the targeted brand. Blocklist inclusion at the network and endpoint levels is recommended, along with monitoring for related domains using similar naming patterns (e.g., 'alertsbotsg,' 'promvda'). The offline status does not eliminate risk; historical logs should be reviewed for connections to this domain prior to takedown. No evidence of a specific phishing kit or payload delivery is present in the available data, limiting further technical attribution.