rublevkateam[.]today

This domain is flagged for elevated-risk brand impersonation targeting Telegram, a widely used messaging platform. The threat involves fraudulent replication of Telegram's branding, login pages, or promotional content to deceive users into disclosing credentials, financial details, or installing malicious software. Analysis indicates the domain is actively used in campaigns designed to exploit trust in the Telegram brand, potentially leading to account takeovers or malware distribution. Infrastructure analysis reveals the domain rublevkateam.today was registered on November 20, 2024, through Web Commerce Communications Limited. It resolves to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). The SSL certificate is issued by Let's Encrypt (serial number E8). Security vendor assessments on VirusTotal show 11 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The page title, RublevkaTeam, does not match Telegram's official branding, further indicating fraudulent intent. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.96.3) at network perimeter controls. Security teams should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate fingerprint for detection in logs and endpoint protection systems. User awareness training should emphasize verifying domain authenticity before entering credentials, particularly for messaging platforms. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to identify related threats.