tegegrann[.]jdjdkdk[.]one

This domain is flagged as an elevated-risk brand impersonation threat targeting Telegram users. Analysis indicates the infrastructure is designed to deceive victims into disclosing login credentials, authentication codes, or personal data through a fraudulent interface mimicking the legitimate messaging platform. The threat type is classified as credential harvesting with potential secondary payload delivery, given the historical patterns of similar impersonation schemes. Infrastructure analysis reveals the domain tegegrann.jdjdkdk.one was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 107.148.55.183, hosted in Hong Kong under autonomous system AS398478 (PEG TECH INC). Security vendors on VirusTotal flagged the domain at a ratio of 18/95, indicating moderate consensus on its malicious nature. The domain lacks an SSL certificate, increasing the risk of interception during data transmission. It appears on one security blocklist and was previously blocked by PhishDestroy. The page title was recorded as 'Telegram,' further confirming the intent to impersonate the legitimate service. The domain is currently offline, though historical resolution and registration data remain valid for threat correlation. Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP (107.148.55.183) across all network security controls, including firewalls, DNS filters, and email gateways. Organizations should monitor for internal traffic to the domain or IP, particularly from endpoints with access to sensitive communications. End-users should be alerted to verify domain authenticity before entering credentials, especially for messaging platforms. Security teams are advised to review logs for connections to the IP or domain within the past 90 days, as the registration date suggests recent malicious activity. Given the lack of SSL, any historical traffic to this domain should be treated as high-risk for credential exposure. Proactive measures include deploying indicators of compromise (IOCs) to threat intelligence platforms and conducting phishing awareness training focused on brand impersonation tactics.