stickerdom[.]shop

Analysis of stickerdom.shop, a domain created on February 21, 2026 and currently taken offline, reveals multiple indicators of a wallet/seed phishing operation that impersonates the Telegram brand. The domain resolves to the IPv6 address 2606:4700:3030::6815:3001, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. Registration details list Web Commerce Communication Ltd. as the registrar, and the authoritative nameservers are ns100.webnic.cc and ns101.webnic.cc. The site presented the page title "Bored Ape Originals," a title that bears no obvious relation to Telegram and suggests a possible attempt to lure users with a popular NFT reference while diverting focus from the underlying credential‑harvesting intent.

Two of ninety‑three security vendors on VirusTotal flagged the domain, indicating that a minority of scanners identified malicious characteristics. Additionally, the domain appears on two independent blocklists—PhishDestroy and ScamSniffer—providing corroborating evidence of its phishing nature. The SSL certificate is reported as "WE1," confirming that the site employed TLS, though the certificate alone does not mitigate the phishing risk.

While the site is presently offline, the observed infrastructure—Cloudflare edge hosting, WebNIC name servers, and a recent registration date—matches patterns commonly employed by short‑lived impersonation campaigns. Defenders should continue to block the domain at perimeter filters, update URL and domain blocklists, and monitor for any re‑registration attempts. Threat intelligence teams should also correlate any inbound traffic to the associated IP address with other known Telegram‑related phishing incidents. Because the content behind the page title has not been captured, further forensic collection is recommended if the site becomes reachable again, to verify the exact phishing payload and any associated cryptocurrency seed‑capture mechanisms.