mxx9090[.]net

This domain presents an elevated risk due to its specific threat type: brand impersonation targeting Telegram. PhishDestroy assesses that the domain was designed to deceive users into believing it was associated with Telegram, potentially for credential harvesting or malware distribution. The threat level is elevated, meaning immediate attention is warranted, though the domain has since been taken offline.

Technical indicators are numerous and concerning. VirusTotal flagged the domain with 18 out of 95 security vendors marking it as malicious. The domain mxx9090.net was registered through NameCheap, Inc. and resolves to IP address 45.200.67.198. It was created on January 13, 2020, giving it a long history of possible malicious activity. AlienVault OTX found it in 17 threat intelligence pulses, and it appears on 2 security blocklists. The page title was "ManBetX(万博体育)官网|英超狼队和水晶宫全球赞助伙伴", which is unrelated to Telegram but may have been used to lure users. The SSL certificate was issued by Google Trust Services / WE1. Despite being offline, the domain's past activity poses residual risks.

For mitigation, users should avoid any interaction with emails, links, or files associated with mxx9090.net. If any credentials were entered on this domain, they should be changed immediately on the legitimate Telegram site. Organizations should block the IP 45.200.67.198 and add the domain to their blocklists. Monitoring for similar domains with slight variations is recommended, as brand impersonators often register multiple lookalike domains. PhishDestroy advises enabling two-factor authentication on Telegram accounts and reporting any suspected phishing attempts to the appropriate authorities.