telegram-software[.]site

This domain, telegram-software.site, is flagged as an active phishing infrastructure impersonating Telegram, a widely used messaging platform. Registered on February 21, 2026, through Hosting Ukraine LLC, the domain remains operational despite its reported malicious activity. Infrastructure analysis reveals the use of Cloudflare nameservers (gemma.ns.cloudflare.com and randy.ns.cloudflare.com) and resolution to IP 104.21.3.64, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain employs HTTP/3 and is protected by a Google Trust Services SSL certificate (WE1), which is consistent with modern phishing campaigns leveraging legitimate CDN and security services to evade detection. The domain is listed on one security blocklist (PhishDestroy) under the classification of social media phishing. A 429 HTTP status code and the page title 'Website was disabled' suggest the site may be undergoing temporary takedown or evasion measures, though it remains resolvable and active. MX records point to mx.services, which may indicate email capabilities for credential harvesting or further phishing distribution. Two of 93 security vendors on VirusTotal have flagged the domain, providing additional confirmation of its malicious nature. Defenders should treat this domain as high-risk due to its confirmed impersonation of Telegram, use of Cloudflare for obfuscation, and active phishing classification. The domain’s infrastructure, including its nameservers, IP resolution, and SSL certificate, aligns with known phishing patterns. While the exact content or phishing kit in use is not yet analyzed, the combination of brand impersonation, blocklist presence, and technical indicators warrants immediate blocking and monitoring. Further investigation into associated email infrastructure (mx.services) is recommended to disrupt potential follow-on attacks.