minerswiss[.]com

minerswiss.com has been identified as an active brand‑impersonation site targeting Telegram users. The domain was registered on 2025-01-03 through NameCheap, Inc. and currently resolves to the IP address 172.67.175.60, which belongs to Cloudflare’s AS13335 network and is geolocated in the United States. HTTP requests to the host return a 302 redirect, and the site presents the page title “TG WebApp”, indicating a direct reference to the Telegram brand.

Ownership information is limited to the registrar; the domain uses the Cloudflare nameservers alaric.ns.cloudflare.com and jule.ns.cloudflare.com. No TLS certificate is presented, leaving the connection unencrypted and exposing users to potential credential capture. The lack of an SSL certificate is atypical for a site that pretends to be a legitimate service and reinforces the malicious intent.

Threat intelligence flags minerswiss.com as a brand‑impersonation campaign. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 2 of 95 security vendors have flagged the domain as malicious. The site is listed on a public blocklist and has been actively blocked by PhishDestroy, yet it remains reachable. The combination of a brand‑related page title, the low trust score, and the presence on blocklists provides concrete evidence of a phishing infrastructure aimed at harvesting Telegram credentials.

Defenders should immediately add minerswiss.com to network deny lists and configure DNS filtering to prevent resolution. Monitoring of the associated IP 172.67.175.60 and its Cloudflare ASN should be continued, as the infrastructure may be reused for additional impersonation campaigns. Organizations using Telegram are advised to educate users about unsolicited login prompts and to enforce multi‑factor authentication. Incident response teams should treat any credentials submitted to this domain as compromised and initiate credential rotation.