web[.]quocanh[.]ceo

The domain web.quocanh.ceo was observed hosting a Telegram brand‑impersonation site. The page title returned by the server reads “Fakebill LePhanQuocAnh – Công cụ fake bill chuyển khoản dùng để seeding,” indicating a fake‑bill generation tool that may have been used to lure victims. The domain was registered on September 4 2025 through CSL Computer Service Langenbach GmbH d/b/a joker.com and is resolved to the Cloudflare edge address 172.67.148.222, belonging to ASN 13335 (Cloudflare, Inc.) located in the United States. DNS resolution uses the Cloudflare name servers ajay.ns.cloudflare.com and stevie.ns.cloudflare.com.

No SSL certificate is presented, and the site currently returns an offline HTTP status, confirming that the malicious content has been taken down. Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on one security blocklist. VirusTotal analysis recorded three positive detections out of ninety‑five scanners. PhishDestroy has also blocked the domain.

The risk rating is elevated, reflecting the targeted impersonation of the Telegram brand. While the offline status limits immediate exposure, the infrastructure details—Cloudflare hosting, low trust score, and presence on blocklists—suggest that the operators may reuse the same hosting configuration for future campaigns. Defenders should add the domain and its associated IP address to block lists, monitor for any re‑registration or resurrection of the site, and watch for similar page‑title patterns in future traffic. Continuous ingestion of feeds that reference the Cloudflare name servers and the registrar joker.com can help detect related infrastructure early.