twoixpxp[.]sbs

Analysis of the domain twoixpxp.sbs indicates a high‑risk generic phishing operation that remains active as of July 19, 2026. The site is hosted on IP 27.124.47.186, which maps to a Hong Kong facility identified as Rackip Consultancy Pte. Ltd. DNS resolution is provided by ns3.my-ndns.com and ns4.my-ndns.com, and the TLS certificate presented is issued to Telegram with a wildcard *.local, an uncommon pairing that may be used to obscure the true service intent. An HTTP request returns status code 200 and the page title is reported as "Messenger," suggesting the site may be attempting to lure users into a messaging‑related credential harvest. Registration information shows the domain was acquired through NICENIC INTERNATIONAL GROUP CO., LIMITED. Threat intelligence marks the domain on one blocklist and it has been flagged by PhishDestroy. AlienVault OTX references the domain in two separate pulses, and VirusTotal analysis shows 16 of 91 security vendors have flagged the domain as malicious. While the exact phishing template and targeted credentials are not publicly disclosed, the convergence of a misleading TLS certificate, active hosting, and multiple independent detections confirms a credible phishing threat. Defenders should block the domain at perimeter filters, monitor outbound DNS queries for the associated IP and nameservers, and consider adding the domain to internal blocklists. Continuous re‑scanning is advised to capture any changes in payload or hosting infrastructure.