botvgrs[.]online

The domain botvgrs.online was registered on February 21, 2026 through the REGRU-RU registrar and is currently active. The site presents a page titled “Telegram: Launch @Vavadaplay_bot”, which directly mimics the official Telegram branding and suggests the presence of a Telegram bot. This visual impersonation aligns with the reported brand_impersonation threat type, indicating an attempt to deceive Telegram users into interacting with a malicious service.

Technical analysis shows that botvgrs.online resolves to the IP address 149.154.167.99, an address located in the Netherlands and assigned to AS62041, which is owned by Telegram Messenger Inc. The domain uses authoritative nameservers eugene.ns and faye.ns and serves content over HTTPS with a Let’s Encrypt R13 certificate. HTTP requests receive a 302 redirect response, and the web server is identified as Nginx hosting a Bootstrap front‑end with HTTP Strict Transport Security enabled.

Risk scoring from multiple sources places the domain at a high threat level. It appears on one public blocklist and is listed as blocked by PhishDestroy. VirusTotal reports a single positive detection out of 95 scanned security vendors, suggesting limited visibility but not exonerating the site. The combination of brand impersonation, redirection behavior, and the use of legitimate Telegram‑owned IP space raises confidence that the domain is being leveraged to harvest credentials or deliver additional payloads.

Defenders should treat botvgrs.online as malicious. Immediate actions include adding the domain to DNS and proxy blocklists, monitoring for any outbound connections to the associated IP address, and alerting end‑users about the fraudulent Telegram bot reference. Continuous observation of new domains registered through the same registrar or using the same nameservers is advised, as these indicators often precede broader campaigns targeting Telegram users.