telegramwebs[.]com

This domain is flagged for elevated-risk brand impersonation, specifically targeting Telegram, a widely used messaging platform. Analysis indicates the site operated under the guise of a marketplace or storefront, as evidenced by the page title "TK Store | buy, sell and discover on TK," which closely mimics Telegram’s branding and functionality. Such impersonation schemes are frequently leveraged to deceive users into divulging sensitive information, engaging in fraudulent transactions, or downloading malicious payloads under the pretense of legitimate services.

Infrastructure analysis reveals multiple high-risk indicators. The domain telegramwebs.com was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 45.135.237.33, hosted by OWGELS INTERNATIONAL CO., LIMITED (AS153656) in Hong Kong. The SSL certificate is issued by Let's Encrypt (identifier: E8), a common choice for both legitimate and malicious domains. Security vendors on VirusTotal flagged the domain as malicious, with 21 out of 95 engines detecting it. The domain appears on at least one security blocklist and was taken offline following detection by automated threat intelligence systems. The combination of a recently registered domain, a hosting provider with a history of abuse, and a high detection rate among security vendors underscores the elevated risk.

Mitigation steps for this type of brand impersonation threat include immediate domain blacklisting across enterprise and consumer security tools. Organizations should monitor for user interactions with the domain or its associated IP address (45.135.237.33) in network logs and proxy data. End-users should be educated on recognizing impersonation tactics, such as verifying domain names for subtle misspellings or unusual TLDs, and cross-referencing official brand communications for legitimacy. Security teams are advised to review historical DNS records and SSL certificate transparency logs to identify potential collateral domains registered under the same infrastructure or certificate authority. Proactive monitoring for similar impersonation attempts targeting Telegram or other high-profile brands is recommended.