telegapp[.]shop

On July 24, 2026 the domain telegapp.shop was observed hosting a generic phishing campaign. The domain was created on 21 February 2026 and is registered through Gname.com Pte. Ltd. Its authoritative nameservers are a4.share-dns.com and b4.share-dns.net. DNS resolution points to the IPv4 address 172.245.67.31, which belongs to AS36352 operated by HostPapa in the United States. The same host presents an SSL certificate bound to 172.245.67.50, indicating a mismatched certificate that is typical of malicious infrastructure. The site’s HTML title reports “进入首页”, but no further content analysis is available because the service is currently offline.

Reputation services have flagged the domain: it appears on one security blocklist and is blocked by PhishDestroy. Google Safe Browsing classifies it as social engineering. VirusTotal records show 13 of 93 scanning engines issuing a detection, reinforcing the malicious assessment. AlienVault OTX references the domain in a single threat‑intel pulse. Collectively, these indicators confirm that telegapp.shop is being used for phishing, likely targeting Chinese‑language users given the page title.

Uncertainty remains regarding the exact phishing lure, credential‑stealing mechanisms, and any additional payloads, as no page content was captured before takedown. The current offline status suggests the malicious site has been taken down, but the infrastructure may be reused. Defenders should add the domain and its IP address to blocklists, monitor the associated nameservers for future redirection, and enforce outbound filtering to prevent connections to the host. Network defenders should also consider sink‑holing the IP address to gather further intelligence. Continuous observation of the registrar’s activity and periodic re‑resolution of the domain are recommended to detect potential re‑hosting.