telegrameem[.]com

Analysis of telegrameem.com confirms an active brand-impersonation campaign targeting Telegram users. The domain was registered on July 17, 2025, through P.A. Viet Nam Company Limited and remains operational as of July 12, 2026. The page title, '纸飞机下载 - TG官方中文版下载 | 安全、快速的即时通讯工具,' explicitly references Telegram's Chinese nickname ('纸飞机') and claims to offer an official Chinese version of the application, suggesting a focus on Mandarin-speaking users. Infrastructure analysis reveals the domain resolves to IP 216.150.1.65 and employs Netlify hosting with HSTS enabled. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate. The domain is flagged by 23 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, including PhishDestroy and BLP-Malware. Sixteen of 95 security vendors on VirusTotal detect the domain as malicious. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and confirmed presence on multiple blocklists. Network-level blocking is recommended, particularly for organizations with users in regions where Mandarin is prevalent. No evidence currently links this domain to specific malware families or secondary payload delivery, but monitoring for associated IPs and certificates is advised for potential campaign expansion.