geteegztd[.]store

On 21 February 2026 the domain geteegztd.store was registered through the REGRU‑RU registrar and assigned the Russian name servers ns1.reg.ru and ns2.reg.ru. The domain resolves to the IPv4 address 31.57.34.181, which is announced by AS207994 (Blockchain Creek B.V.) and geolocated to the Netherlands. No TLS certificate is presented; the web service responded over HTTP/3 without encryption, which is atypical for credential‑stealing sites that usually employ HTTPS to gain user trust. The only visible page element captured is the title “Маркет – Getgems”, which does not reference the targeted brand. Nevertheless, the intelligence set classifies the campaign as a brand‑impersonation attempt against Telegram, indicating that the operator likely intends to lure Telegram users to a counterfeit service.

VirusTotal analysis recorded 2 detections out of 93 scanned security vendors, confirming that at least a minority of scanners flagged the domain as malicious. Independent reputation services assign a Gridinsoft trust score of 0 / 100 and list the domain on a single public blocklist. PhishDestroy has already taken the domain offline and added it to its blocklist, reducing immediate exposure but not guaranteeing that the infrastructure will not be reused. The limited evidence leaves several aspects uncertain: the exact phishing kit, the presence of credential‑capture forms, and any additional hosting infrastructure beyond the single IP are not publicly disclosed.

Defenders should therefore treat the domain as a confirmed malicious indicator. Recommended actions include adding geteegztd.store and its resolving IP 31.57.34.181 to network‑level deny lists, monitoring the registrar REGRU‑RU for new registrations that reuse the same name‑server pattern, and updating URL‑filtering rules to block any future resolution to the same host.