fakebillck[.]io

This domain fakebillck.io is flagged under brand_impersonation with telegram listed as the explicit target in available intelligence. The domain was registered on November 30 2025 through Dynadot LLC and currently resolves to the Cloudflare IP 104.21.46.48 under AS13335. Nameservers brett.ns.cloudflare.com and sneh.ns.cloudflare.com are in use along with an SSL certificate issued by Google Trust Services WE1. HTTP status returns a 301 redirect while the recorded page title is FakeBillck.io - Dịch vụ Fake Bill Uy Tín, Nhanh Chóng. The entry appears on one security blocklist and is blocked by PhishDestroy with a Gridinsoft trust score of 0/100.
Analysis indicates that VirusTotal detection stands at 5 out of 95 vendors and AlienVault OTX records the domain inside a single threat intelligence pulse. Infrastructure analysis reveals consistent use of Cloudflare Browser Insights, Cloudflare edge services and HTTP/3. The registration age, nameserver configuration and current IP assignment are all verifiable from passive DNS and certificate transparency sources.
The precise content served behind the 301 redirect has not been retrieved in this dataset so the exact landing page layout remains unexamined. Scam type is recorded as impersonation targeting telegram but no additional campaign identifiers or kit fingerprints are supplied.
Defenders should add the domain and its resolving IP to blocklists, monitor for similar registrations under the same nameservers and review any inbound traffic logs that reference fakebillck.io. Continued observation of the listed blocklist status and threat pulse activity is recommended to track any infrastructure changes.