telegramamr[.]com

Analysis of telegramamr.com shows a domain created on July 19, 2025 and registered through Gname.com Pte. Ltd. The domain resolves to IP address 43.162.112.44, which is hosted in the United States and assigned to ASN 132203, a Tencent facility located on Kejizhongyi Avenue. DNS resolution uses the authoritative nameservers a8.share-dns.com and b8.share-dns.net. An HTTPS service is present, employing a Let's Encrypt certificate identified as YE1, but the web server returns an HTTP 503 status code, indicating the site is currently unavailable.

The page title retrieved from the endpoint is "硅般飞船下载 - TG般船中文版", which references a Chinese-language download page and aligns with the reported scam type of social media phishing that impersonates the Telegram brand. The domain has been flagged by PhishDestroy and appears on a single security blocklist. VirusTotal scans show that 15 of 95 security vendors marked the domain as malicious, reinforcing the elevated risk rating.

Given the observed infrastructure, the domain should be added to network deny lists, and traffic to its IP address should be blocked. Security operations should also monitor for newly registered domains using the same registrar, similar name patterns, or identical nameserver configurations, as these may indicate a broader campaign targeting Telegram users. Continuous re‑evaluation is advised in case the site becomes active again or additional detection data emerges.