uzbekistondaromad[.]xyz

This domain, uzbekistondaromad.xyz, presented a page titled "Переход в Telegram-канал" (Russian for "Transition to Telegram channel"). The site likely served as a redirect or gateway to a Telegram channel, a common tactic used to funnel users to external platforms for further engagement, which may involve phishing, scam operations, or distribution of malicious content. The threat posed is primarily social engineering, leveraging the trust in Telegram to lure users into a controlled environment where they could be targeted for credential theft, financial fraud, or malware delivery.

Technical evidence shows the domain was flagged by 7 out of 95 VirusTotal vendors, including alphaMountain.ai, CyRadar, Fortinet, Gridinsoft, and Seclookup. It is listed on one blocklist. The domain was registered on 2026-02-21 with NiceNIC International Group Co., Limited, and hosted on IP address 65.108.228.42, located in Finland, assigned to AS24940 Hetzner Online GmbH. The domain uses nameservers ns11.nska.net and ns12.nska.net, has no SSL certificate, and is currently offline.

The domain is currently down and offline, indicating it may have been taken down or expired. The risk level is assessed as medium, due to the combination of multiple vendor detections, recent creation date, and the lack of SSL, which suggests a transient, potentially malicious intent. However, the offline status reduces immediate threat.