safeguardbot[.]pages[.]dev

The domain safeguardbot.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline, returning an HTTP 403 status. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2fad, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. The domain is served behind Cloudflare’s edge, presenting HSTS and HTTP/3 support and presenting a Google Trust Services / WE1 SSL certificate, indicating a legitimate‑looking TLS termination. The page title observed during analysis reads "Telegram Safeguard," and the threat intelligence labels the site as a brand impersonation targeting Telegram, specifically a wallet/seed phishing campaign.

VirusTotal records show that 14 of 93 security vendors have flagged the domain, reflecting a moderate level of detection across the ecosystem. Independent blocklists, including PhishDestroy and ScamSniffer, have listed the domain, confirming that external monitoring services consider it malicious. A Gridinsoft trust score of 1 out of 100 further corroborates the low reputation of the host. While the site is no longer reachable, the combination of brand impersonation, a targeted wallet/seed phishing narrative, and the observed infrastructure suggests a deliberate attempt to harvest cryptocurrency credentials from unsuspecting Telegram users.

Defenders should continue to block the domain and its associated IPv6 address at network perimeters, update URL filtering rules, and monitor for any re‑registration attempts that may reuse the same subdomain pattern. Analysts should also watch for similar domains registered through Cloudflare that reference Telegram or employ similar naming conventions, as the infrastructure indicates a reusable phishing kit. The current evidence does not reveal the exact content of the landing page beyond the title, so further investigation would be required if the domain becomes active again.