telegramlogg[.]ru

The domain telegramlogg.ru was registered on 2026-02-21 and is currently taken offline. DNS resolution points to the IP address 149.154.167.99, which is geolocated to the Netherlands and is announced by ASN 62041, registered to Telegram Messenger Inc. The hosting IP aligns with infrastructure used by the legitimate Telegram service, suggesting the attacker may have leveraged compromised or misconfigured resources within the official network. The site presents the page title "Telegram Messenger," matching the targeted brand and reinforcing the impersonation claim.

An SSL certificate issued by Go Daddy Secure Certificate Authority - G2 is present, indicating a valid TLS termination that may help bypass naïve HTTPS checks. The domain appears on a single security blocklist and is specifically listed by PhishDestroy, confirming that at least one external repository has flagged it as malicious. VirusTotal analysis shows that 2 of 93 security vendors have flagged the domain, providing limited but corroborating evidence of malicious intent.

The reported scam type is a crypto scam, although no additional payload or transaction details are available. Defenders should block DNS resolution for telegramlogg.ru, monitor outbound connections to 149.154.167.99, and enforce TLS pinning for legitimate Telegram endpoints to detect potential certificate misuse. Continuous re‑evaluation of blocklist status and additional sandbox analysis are recommended to capture any evolving payloads associated with this infrastructure.