Is k.ttink.ru safe?
http://k.ttink.ru/
Checked on
How we checked
Coverage: strong · 4 of 6 applicable core capabilities
- Antivirus (59 of 92 engines answered) · saved result: did not fully complete
- Google Safe Browsing: completed
- page reading · limited: did not fully complete
- page capture: completed
- domain records: completed
- web research: completed
A 38-day-old host that bounces visitors through a parking redirect into a Telegram invite page dressed up as Telegram itself
k.ttink.ru serves nothing of its own. It redirects to its own /err path, then cross-domain to parkingdomain.cc, which shows only "Redirecting to your destination..." and "Please wait while we redirect you..." before handing the visitor to a Telegram invite link. The page a visitor ends up on copies Telegram's header and DOWNLOAD button and centres a card titled "Elena" with the line "A backup channel so you don't lose me". No operator, business, product, terms or contact route is disclosed, and the parent domain ttink.ru is 38 days old. There is no confirmed payment or credential theft, but the whole structure exists to move strangers into a private chat channel under a borrowed brand, which is why this scores in the High Risk band.
Saved site captureCaptured safely during this scan3 antivirus engines flagged this URLChong Lua Dao, alphaMountain.ai, FortinetSaved antivirus result from Oct 4, 2026Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 30/100
High Risk covers scores 21–44. 7 findings pulled the score down; 1 pushed it up.
What pulled the score down
- StrongA primary play, convert, continue, or download control opened an unrelated external destination.-6 pts
- Strong1 independent antivirus family reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.-2 pts
- Moderatek.ttink.ru redirects to its own /err path and then cross-domain to parkingdomain.cc, which only displays redirect-wait text before sending the visitor onward.-2 pts
- MinorThe page redirected the browser to an unrelated external domain.
- MinorThe landing page copies Telegram's header, logo and DOWNLOAD button, then centres a card titled "Elena" with "A backup channel so you don't lose me" and a chat invite link.
- MinorThe prominent DOWNLOAD button opened telegram.org/apps instead of delivering anything from this site.
- MinorNo operator, company, product, policy page or contact route is presented on the host, and the redirect destination's contacts were not attributed to it.
What pushed the score up
- SupportsSafe Browsing raised no warning, TLS was valid, and the hosting IP has no saved abuse reports.
Points come from the saved evidence ledger: it lowered the score from 40 to 30 and split those 10 points between the findings that show points; the others carry no points in the ledger.
Lost money or shared details on k.ttink.ru? Do this now
Act quickly: the first hours matter most for a chargeback.
- Call your bank or card issuer now
Ask them to dispute the charge or open a chargeback; the sooner you act, the better your odds. Card payments can often be reversed. Bank transfers and gift cards are harder, but report them to your bank too. Crypto payments usually cannot be reversed: report the wallet address and transaction ID to the exchange you sent from.
- Change any password you entered
If you entered a password on k.ttink.ru, change it there and anywhere you reused it, and turn on two-factor authentication. Keep screenshots, order confirmations and messages as evidence.
- Report the site
Reports help get scam sites taken down faster and warn other people.
- Report the domain to its registrar
The registrar is the company that sold this domain. ICANN's lookup shows the registrar's abuse contact.
- Ignore anyone offering to recover your money
"Recovery" services or agents who contact you, or ask for a fee up front, are almost always a second scam aimed at victims. Your bank's dispute process and the official reporting services never charge a fee in advance.
Full answers about refunds and reporting are in the Safety FAQ below.
01 · Investigation Brief
Investigation Brief
k.ttink.ru serves nothing of its own. It redirects to its own /err path, then cross-domain to parkingdomain.cc, which shows only "Redirecting to your destination..." and "Please wait while we redirect you..." before handing the visitor to a Telegram invite link. The page a visitor ends up on copies Telegram's header and DOWNLOAD button and centres a card titled "Elena" with the line "A backup channel so you don't lose me". No operator, business, product, terms or contact route is disclosed, and the parent domain ttink.ru is 38 days old. There is no confirmed payment or credential theft, but the whole structure exists to move strangers into a private chat channel under a borrowed brand, which is why this scores in the High Risk band.
The site is a redirect hop, not a destination
Requesting k.ttink.ru sends the browser to k.ttink.ru/err and then off-domain to parkingdomain.cc/as/. The interstitial there carries no content beyond "Redirecting to your destination..." and "Please wait while we redirect you...", so the visitor never sees a shop, a product, a service or any explanation of who is behind the address.
The chain ends at a Telegram invite link, t.me/m/BMKsbn9JMTJk. That is the entire conversion path: a stranger is passed from a throwaway subdomain through a parking page into a private messaging channel. The parent domain ttink.ru was registered 38 days ago, which fits a disposable redirect host rather than an established service.
A Telegram look-alike page fronting a personal "backup channel"
The rendered page carries a Telegram logo and the word "Telegram" with a blue DOWNLOAD button in the top-right corner, copying the layout of Telegram's own site. Below it sits a card titled "Elena" reading "A backup channel so you don't lose me", with a t.me/+ invite link and a blue SEND MESSAGE button.
The DOWNLOAD control does not deliver any file from this site; it navigated the browser to telegram.org/apps, an unrelated external destination. So the page's main button is a decoy that moves the visitor off-site, and the real purpose of the page is the chat invite. Nothing on the page names an operator, a company, a product or a contact route, and the contact details of the redirect destination were not attributed to this host.
Clean connection checks do not offset the operator picture
The browser threat feed returned no threat warning and the saved TLS check found a valid encrypted connection, and the hosting IP has no abuse reports on file. Those results mean no detection was raised at the time of the check; they say nothing about who runs the redirect or what the Telegram channel contains.
A saved antivirus observation records one malicious family and two suspicious results, including a spam verdict and a "newly registered websites" categorisation. That observation is stale, so it is treated as a real but dated signal rather than a current verdict. No malware payload, download or credential form was observed on this host itself.
Independent web research returned nothing usable for this host, so the operator's public reputation is unverified. Combined with an undisclosed operator, a 38-day-old parent domain and a chain that terminates in a private chat invite, the operator side of the assessment is the decisive one.
Why the score is 30
A primary play, convert, continue, or download control opened an unrelated external destination.
02 · Security Evidence
Security evidence
Antivirus Engines
3/ 92
detectionsSaved analysis from October 4, 2026 - stale
3 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 1
- Suspicious
- 2
- Total
- 92
| Engine | Finding |
|---|---|
| Chong Lua DaoMalicious | malicious |
| alphaMountain.aiSuspicious | spam |
| FortinetSuspicious | spam |
All 92 engine results
- Chong Lua Dao - Malicious
- alphaMountain.ai - spam - Suspicious
- Fortinet - spam - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- alphaMountain.aiSpam
- Forcepoint ThreatSeekernewly registered websites
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Visual context from the captured page
Page header shows a Telegram logo and the word 'Telegram' with a blue 'DOWNLOAD' button at top right, mimicking Telegram's own site. Centered card titled 'Elena' with the text 'A backup channel so you don't lose me', a t.me/+FBqLZhL7q-FINmFk invite link and a blue 'SEND MESSAGE' button. A prominent 'DOWNLOAD' button is present in the top-right corner of the page.
What the captured page showed
3 observations- 01
Page header shows a Telegram logo and the word 'Telegram' with a blue 'DOWNLOAD' button at top right, mimicking Telegram's own site.
- 02
Centered card titled 'Elena' with the text 'A backup channel so you don't lose me', a t.me/+FBqLZhL7q-FINmFk invite link and a blue 'SEND MESSAGE' button.
- 03
A prominent 'DOWNLOAD' button is present in the top-right corner of the page.
What the page says about itself
Quoted from the pages we read: the site's own words, not our findings.
- Page title
Redirecting...
Pages we read
- Main page/as/Read
03 · Investigation Story
Investigation story
What the site claims
Redirecting...
What we observed
Saved browser evidence recorded forced redirects, cross domain landing.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
2 of the 6 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Phishing & Impersonation
Service and business model
Unknown
Observed behavior
Evidence behind this classification
- 01The page redirected the browser to an unrelated external domain.
- 02A primary play, convert, continue, or download control opened an unrelated external destination.
- 03The landing page copies Telegram's header, logo and DOWNLOAD button, then centres a card titled "Elena" with "A backup channel so you don't lose me" and a chat invite link.
Web research findings
Independent findings for k.ttink.ru, including public complaints, named review sources, registration records, and look-alike-domain evidence.
No independently sourced scam reports or credibility records were found for k.ttink.ru. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too.
Infrastructure map
- Domaink.ttink.ru
- Redirects tot.me
- Hosted byCloudflare, Inc.
- Referenceselfile.net · static.cloudflareinsights.com
Domain Timeline
- Sep 28, 2026Domain registered
First appeared in WHOIS records — 38 days old when this review was saved.
- Nov 5, 2026Saved security review — Rated High Risk
The completed checks from this saved scan are detailed above.
k.ttink.ru was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
Domain & Encryption
This is the certificate of t.me, the site this URL lands on. Certificate issued for *.t.me.
A shared Cloudflare address answers for many sites, so it is not the site's own server and says nothing about who runs it. This is the address of parkingdomain.cc, the site this URL lands on.
Analytics and ads
- Cloudflare Web Analytics
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1302http://k.ttink.ru/
- 2302http://k.ttink.ru/err
- 3302https://parkingdomain.cc/as/cross-domain
- 4200https://t.me/m/BMKsbn9JMTJkcross-domain
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentpartial
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
A primary play, convert, continue, or download control opened an unrelated external destination. · 1 independent antivirus family reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
Operator / customer risk
unknownComplaints, withdrawals, business conduct and commercial traps.
The page redirected the browser to an unrelated external domain.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 3 of 92 engines flagged | Limited | Adverse | stale fallback · analysed Oct 4, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Nov 5, 2026 |
| Page content | Page fetched · HTTP 200 | Limited | No saved finding | this scan · Nov 5, 2026 |
| Visual evidence | 3 visible observations saved with the page capture | Completed | No adverse finding | this scan · Nov 5, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Nov 5, 2026 |
- Antivirus
- Result3 of 92 engines flagged
- CompletionLimitedFindingAdverse
- Freshnessstale fallback · analysed Oct 4, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionLimitedFindingNo saved finding
- Freshnessthis scan · Nov 5, 2026
- Visual evidence
- Result3 visible observations saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
07 · Safety FAQ
Safety FAQ
Answered from the saved verdict and evidence in this report.
Is k.ttink.ru a scam or a legit website?
Is k.ttink.ru safe to use?
What should I do if I already gave my details to k.ttink.ru?
Can I get my money back from k.ttink.ru?
Did k.ttink.ru steal my password or personal information?
How do I report k.ttink.ru?
Why does k.ttink.ru look legitimate if it's a scam?
Has k.ttink.ru been flagged by antivirus engines?
Is k.ttink.ru on any phishing or malware blacklists?
How old is the k.ttink.ru domain?
Does k.ttink.ru have a valid SSL certificate?
How often is the k.ttink.ru report updated?
08 · Final Verdict
Final verdict
A 38-day-old host that bounces visitors through a parking redirect into a Telegram invite page dressed up as Telegram itself
k.ttink.ru serves nothing of its own. It redirects to its own /err path, then cross-domain to parkingdomain.cc, which shows only "Redirecting to your destination..." and "Please wait while we redirect you..." before handing the visitor to a Telegram invite link. The page a visitor ends up on copies Telegram's header and DOWNLOAD button and centres a card titled "Elena" with the line "A backup channel so you don't lose me". No operator, business, product, terms or contact route is disclosed, and the parent domain ttink.ru is 38 days old. There is no confirmed payment or credential theft, but the whole structure exists to move strangers into a private chat channel under a borrowed brand, which is why this scores in the High Risk band.
09 · Community
Community
Are you the owner of k.ttink.ru?Verify and reply