Highscore 53 · flagged Tuesday, October 27, 2026

telegram-jp.club

Appeared in the .club zone on Tuesday, October 27, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: telegram
+30
brand name at a retail registrar
matched: Hefei Juming Network Technology Co., Ltd
+8
brand name and brand-styled page
matched: telegram
+15
Registrar
Hefei Juming Network Technology Co., Ltd
Nameserver provider
Nameservers
ns1.onclouddns.com, ns2.onclouddns.com
First-day state
active website
HTTP status
200
Page title
Telegramダウンロード|PC・Mac・Android・iPhoneのインストールガイド
Has a form
no
Brand echoed
telegram

Model opinions

Second opinionlooks like abusetarget: Telegramconfidence 80%· claude-opus-5-5

The domain is a Telegram brand-squat registered through a Chinese retail registrar, and the page poses as an unofficial Telegram download portal. Its Japanese/Korean template is clearly mass-produced, the shape of SEO-poisoning fake-installer sites. The download links currently point to telegram.org, so no payload is confirmed yet, but these are decoys that can be swapped for trojanized installers.

First passlooks like phishingtarget: Telegramconfidence 92%· claude-haiku-4-5

The domain telegram-jp.club impersonates Telegram's official branding, design, and messaging with a Japanese-language download guide page that mimics Telegram's visual identity and claims to offer 'official app' installation. The page contains no login form, but the infrastructure (brand-typosquat domain, third-party registrar, links to real Telegram sites as decoys) and content (posing as an authoritative installation guide under Telegram's branding) are consistent with credential-harvesting or

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, October 27, 2026

Screenshot of telegram-jp.club taken by the zone census on 2026-10-27

Same data as JSON: /api/zone/domain/telegram-jp.club. This page is not indexed by search engines and does not link to the site it describes.