telegramrig[.]com

The domain telegramrig.com was registered on July 24, 2025 through GoDaddy.com, LLC and is currently taken offline. DNS resolution points to the IP address 104.21.96.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers, elly.ns.cloudflare.com and leonard.ns.cloudflare.com, are operated by Cloudflare, confirming that the infrastructure is fully cloud‑based. The site presented a page titled "Telegram中文版 - Telegram中文版下载," indicating content unrelated to the targeted brand but still consistent with a social‑media phishing campaign that claims to impersonate Google.

The TLS certificate is issued by Google Trust Services under the WE1 label, providing a legitimate‑looking HTTPS connection that could be used to lend credibility to the malicious page. Detected web technologies include Cloudflare’s edge services and HTTP/3 support, both of which are typical for fast‑cached malicious sites. Threat intelligence shows that the domain has been flagged by six of ninety‑five VirusTotal scanners and appears on one external security blocklist.

PhishDestroy has also blocked the domain, reinforcing the assessment that it was used for brand impersonation. Although the site is no longer active, defenders should continue to monitor the IP address 104.21.96.1 and associated Cloudflare name servers for any re‑use, enforce blocklisting of telegramrig.com in network and endpoint controls, and consider adding the IP to threat feed subscriptions. Ongoing vigilance is recommended because the same hosting infrastructure can be repurposed for future phishing campaigns targeting Google or other high‑profile brands.