telegramgke[.]com

Analysis of the domain telegramgke.com indicates active brand impersonation targeting Telegram users, specifically those seeking Chinese-language versions of the messaging application. The domain was registered on July 17, 2025, through P.A. Viet Nam Company Limited, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to 216.150.16.193 (AS16509, Amazon.com, Inc., US) and employs nameservers ns1.pavietnam.vn, ns1.vercel-dns.com, and ns2.vercel-dns.com, suggesting a mix of hosting and DNS providers. Detected technologies include Netlify and HSTS, while the SSL certificate is issued by Google Trust Services (WE1). The page title, '纸飞机下载 - 纸飞机官方中文版下载 | 安全、快速的即时通讯工具,' explicitly references '纸飞机' (Paper Airplane), a common Chinese colloquial term for Telegram, reinforcing the impersonation of the official Telegram application. The domain is flagged by 17 of 95 security vendors on VirusTotal and appears in 23 threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. It is also blocked by two security blocklists, including PhishDestroy and BLP-Malware. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, Chinese-language targeting, and detection by multiple security vendors confirms high-risk social engineering activity. Defenders should treat this domain as active phishing infrastructure and prioritize blocking or monitoring its resolution and associated IP addresses. The 301 HTTP status suggests potential redirection to additional malicious endpoints, warranting further investigation into downstream infrastructure.