maxkorzh[.]kz

This domain, maxkorzh.kz, is flagged for brand impersonation targeting Telegram, a widely used messaging platform. Analysis indicates the site masqueraded as an official event page titled 'Макс Корж в Алматы! 6 сентября 2025,' leveraging social engineering to deceive visitors. No crypto drainer or credential theft scripts were explicitly identified, but the infrastructure and impersonation tactics align with phishing campaigns designed to harvest user data or distribute malicious payloads.

Technical indicators confirm elevated risk: the domain is detected by 3 out of 95 security vendors on VirusTotal, resolves to IP address 194.48.203.152, and is registered through ICPS. It appears on two security blocklists (PhishDestroy and OISD) and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently abused in phishing infrastructure to lend false credibility. No Google Safe Browsing (GSB) flags were reported at the time of analysis, though this does not preclude prior or future detections.

The domain is currently offline, reducing immediate exposure. However, the infrastructure remains a latent threat, as domains registered through the same registrar or resolving to the identified IP may re-emerge with similar tactics. Organizations and users are advised to block the domain and IP at the network level, monitor for related indicators (e.g., subdomains, newly registered lookalike domains), and verify event-related communications directly through Telegram’s official channels. Given the use of legitimate technologies (Tilda, Google Tag Manager), future iterations may employ more sophisticated obfuscation.