telegramad[.]org

On 22 July 2026 analysts observed telegramad.org flagged as a brand‑impersonation site targeting the Telegram messaging service. The domain was registered on 24 June 2025 through Name.com, Inc., and resolves to the Cloudflare‑managed address 104.21.26.163, located in the United States under ASN 13335. DNS resolution uses the Cloudflare authoritative nameservers coby.ns.cloudflare.com and sofia.ns.cloudflare.com, indicating the infrastructure is protected by Cloudflare’s edge network and serves content over HTTP/3. An SSL certificate issued by Google Trust Services (WE1) was presented, confirming HTTPS was enabled at the time of observation. An HTTP request returned status code 200, and the page title captured was “Telegram中文版下载｜TG纸飞机电脑版/安卓/iOS多平台支持”, which references Telegram in Chinese and suggests a download offering, consistent with the reported social‑media phishing classification.

Reputation signals are strongly negative: the domain appears on a single security blocklist, is listed as blocked by PhishDestroy, and received detections from two of ninety‑five VirusTotal scanners. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. No additional public threat‑intel feeds such as OTX or Safe Browsing were referenced in the available data. The site’s current status is offline, preventing direct content analysis; therefore the exact phishing payload, credential‑stealing form, or redirection chain remains unknown.

Defenders should immediately add telegramad.org to network‑level deny lists, enforce URL filtering, and monitor for any future re‑hosting on alternative IP ranges. Given the use of Cloudflare’s shared infrastructure, traffic may be obscured, so correlation of outbound connections to 104.21.26.163 with other known malicious domains is advised. Continuous re‑scanning of the domain after it reappears online will help capture any evolved payloads.