Criticalscore 63 · flagged Wednesday, September 16, 2026

kupit-zvezdy-telegram-deshevo.online

Appeared in the .online zone on Wednesday, September 16, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: telegram
+30
many hyphens
matched: 3
+6
very long name
matched: 29
+4
brand name at a retail registrar
matched: Registrar of Domain Names REG.RU LLC
+8
brand name and brand-styled page
matched: telegram
+15
Registrar
Registrar of Domain Names REG.RU LLC
Nameserver provider
Nameservers
ns1.hosting.reg.ru, ns2.hosting.reg.ru
First-day state
active website
HTTP status
200
Page title
Купить звёзды Telegram дёшево — DroidStarNice
Has a form
no
Brand echoed
telegram

Model opinions

Second opinionsuspiciousconfidence 60%· claude-opus-5

Keyword-stuffed Russian doorway/affiliate page ('buy Telegram stars cheap') under its own DroidStarNice label, with no form and all three links funnelling to an offsite partner payment service (nicestars.pro); it exploits the Telegram brand in the domain for SEO but does not itself impersonate Telegram or collect credentials, so the risk (unverified third-party payment funnel) is real but not decisive.

First passlooks like a scamconfidence 92%· claude-haiku-4-5

The domain and page sell Telegram Stars (a legitimate Telegram feature) through a third-party reseller claiming to offer cheaper packages without requiring a password. This is a classic reseller scam: users provide their Telegram username and payment, but the Stars either never arrive or the payment is stolen. The page does not impersonate Telegram itself (it uses its own 'DroidStarNice' brand and disclaims password access), but it is fraud—a fake shop luring users with false 'discounted' rates

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Wednesday, September 16, 2026

Screenshot of kupit-zvezdy-telegram-deshevo.online taken by the zone census on 2026-09-16

Same data as JSON: /api/zone/domain/kupit-zvezdy-telegram-deshevo.online. This page is not indexed by search engines and does not link to the site it describes.