Criticalscore 67 · flagged Monday, August 31, 2026

telegram-ka9.vip

Appeared in the .vip zone on Monday, August 31, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: telegram
+30
brand plus digits
matched: telegram-ka9
+8
brand name behind Cloudflare
matched: cloudflare.com
+6
brand name at a retail registrar
matched: July Name Limited
+8
brand name and brand-styled page
matched: telegram
+15
Registrar
July Name Limited
Nameserver provider
Nameservers
pat.ns.cloudflare.com, yevgen.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
Telegram网页版-电报/飞机网页版登录与多线路加速导航中心
Has a form
no
Brand echoed
telegram

Model opinions

Second opinionlooks like phishingtarget: Telegramconfidence 60%· claude-opus-5

Domain telegram-ka9.vip carries the Telegram name and logo and the page presents itself as the 'Telegram 官方网页版' / '网页版登录' portal offering phone-number pairing and 2FA authorisation, funnelling all 13 links to a single off-site host (zhtgcn.com.cn) — the standard Chinese Telegram-web-login SEO doorway campaign that ends in account/code harvesting; no form on this landing page keeps it just short of certainty.

First passlooks like phishingtarget: Telegramconfidence 92%· claude-haiku-4-5

The domain telegram-ka9.vip impersonates Telegram with a Chinese-language navigation hub falsely claiming to offer official Telegram web login and access portals. The page uses Telegram's logo, repeats 'Telegram 官方网页版' (official Telegram web version) and 'Telegram 网页版登录' (Telegram web login) throughout to deceive Chinese users into believing this is a legitimate Telegram service, with all 13 outbound links pointing to a single external host (zhtgcn.com.cn), a hallmark phishing infrastructure pat

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, August 31, 2026

Screenshot of telegram-ka9.vip taken by the zone census on 2026-08-31

Same data as JSON: /api/zone/domain/telegram-ka9.vip. This page is not indexed by search engines and does not link to the site it describes.