tonnelgamerelayerbottelegrambot[.]pro

The domain tonnelgamerelayerbottelegrambot.pro was observed hosting a phishing page that mimics Telegram services, as indicated by the page title "Telegram Web" and the declared brand target "Telegram". Technical inspection shows the domain resolves to the IPv4 address 149.154.167.99, which belongs to ASN AS62041 registered to Telegram Messenger Inc and is geolocated in the Netherlands. Hosting is provided through Cloudflare, with the authoritative nameservers brett.ns.cloudflare.com and ullis.ns.cloudflare.com, and the service is reachable over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain.

Registration records list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar. The site was cataloged by PhishDestroy and appears on a single security blocklist, reflecting its identification as a social media phishing vector. VirusTotal analysis recorded a single detection out of ninety‑five scanners, reinforcing the threat assessment despite the low detection count.

As of the report date, the infrastructure has been taken offline, and the domain status is marked as offline. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP and nameserver patterns, and add the domain to internal phishing and brand‑impersonation watchlists. Ongoing observation of the registrar and Cloudflare name servers is advised in case the infrastructure is re‑activated under a new campaign.