telemxvy[.]com

Analysis of telemxvy.com indicates an active generic phishing infrastructure. The site responds with HTTP 200 and presents a page titled "Messenger," suggesting a possible social messaging lure, though the exact content has not been publicly examined. The domain resolves to 27.124.47.186, an address registered to Rackip Consultancy Pte. Ltd. in Hong Kong, and is served using an SSL certificate identified as "Telegram / *.local," a mismatch that may be used to evade simple certificate checks. Registration was performed via NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. Threat intelligence sources confirm the domain appears on one security blocklist, has been referenced in two AlienVault OTX pulses, and was flagged by 16 of 91 security vendors on VirusTotal. PhishDestroy also lists the domain as blocked. While the infrastructure details are concrete, the specific phishing campaign vectors, targeted brands, and lure mechanisms remain unknown pending content analysis. Defensive teams should block the domain and associated IP at perimeter defenses, monitor DNS queries for the listed name servers, and add the SSL fingerprint to SSL inspection policies to detect mismatched certificates. Ongoing reconnaissance of traffic patterns to the IP and correlation with user reports are recommended to gauge campaign scope.