telebvlx[.]com

telebvlx.com is currently active and serves a page titled “Messenger”. The site resolves to IP 27.124.47.186, which geolocates to Hong Kong and is hosted by Rackip Consultancy Pte. Ltd. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The TLS certificate presented is issued to “Telegram” for the wildcard *.local domain, a mismatch that may indicate misuse of a certificate unrelated to the site’s content. HTTP requests return a 200 status code, indicating the page is reachable. The domain is listed on one security blocklist and has been blocked by the PhishDestroy filtering service. VirusTotal analysis shows 13 of 91 scanners flagging the domain as malicious, and AlienVault OTX references the domain in two separate threat‑intel pulses. No additional technical details about the page’s functionality have been disclosed, so the precise phishing vector remains unknown. Defenders should add 27.124.47.186 and telebvlx.com to deny‑list or firewall rules, monitor DNS queries for the associated name servers, and consider sinkholing the domain to disrupt traffic. Continuous re‑evaluation is advised, as the threat actor may modify the site or employ new infrastructure. Integration of the observed indicators into intrusion‑detection systems will aid in early detection of attempted connections.