telemxwf[.]com

Analysis indicates that telemxwf.com is an active phishing domain targeting users with a fraudulent Messenger-themed page. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to IP address 27.124.47.186, hosted in Hong Kong under Rackip Consultancy Pte. LTD. The page title 'Messenger' suggests an attempt to impersonate the legitimate messaging platform, though no further content analysis has been conducted to confirm specific tactics such as credential harvesting or malware distribution. Infrastructure review reveals the domain uses nameservers ns3.my-nddns.com and ns4.my-nddns.com, a configuration commonly observed in phishing campaigns. The SSL certificate is issued for 'Telegram' and a wildcard *.local domain, which does not match the expected branding for Messenger and may indicate misconfigured or reused certificates. The domain is flagged on one security blocklist (PhishDestroy) and detected by 4 of 91 security vendors on VirusTotal, though the absence of additional detections does not imply safety. Defenders should treat this domain as high-risk. Network-level blocks at 27.124.47.186 and DNS-level blocks for telemxwf.com are recommended. Security teams should monitor for connections to this IP or domain in logs, particularly from systems where Messenger is used. Further investigation into the site's functionality, payload delivery mechanisms, and any associated infrastructure (e.g., redirect chains, drop servers) is advised to determine the full scope of the threat. As of July 20, 2026, the domain remains active and unresolved connections should be treated as potential compromise indicators.