teiegtm[.]qpon

The domain www.teiegtm.qpon was observed resolving to the IPv4 address 172.245.67.31. The address is allocated to AS36352 (HostPapa) and geolocates to the United States. SSL certificate data show the certificate being served from 172.245.67.50, indicating a mismatch between the certificate host and the resolved IP, a pattern frequently associated with malicious hosting setups. Registration information links the domain to Gname.com Pte. Ltd., with a creation timestamp of September 25, 2025.

The authoritative name servers are listed as a6.share-dns.com and b6.share-dns.net, both typical of shared‑DNS services used by transient phishing infrastructures. The site’s HTML title tag contains the Chinese phrase "进入首页", which translates to "Enter Home Page"; no further page content has been publicly disclosed, and the site is presently taken offline. Threat intelligence flags the domain as a brand‑impersonation campaign targeting Telegram, and it has been added to PhishDestroy’s blocklist. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one additional security blocklist.

VirusTotal analysis records 11 of 95 scanning engines flagging the domain as malicious, reinforcing the suspicion of fraud. Given the confluence of registrar, hosting, SSL mismatch, low trust score, and multiple vendor detections, defenders should treat www.teiegtm.qpon as a high‑confidence malicious indicator. Recommended actions include adding the domain and its resolved IP (172.245.67.31) to network‑level deny lists, updating email security gateways to block URLs containing the domain, and monitoring the registrar’s name servers for any re‑registration attempts. Continuous observation of threat‑intel feeds for re‑use of the same infrastructure is advised, as the offline status may be temporary and the actors could redeploy the domain or related assets.