t[.]elcxof[.]co

The domain t.elcxof.co has been identified as a credential theft phishing site targeting users through deceptive login interfaces. Analysis confirms the domain is currently offline, though it previously resolved to infrastructure associated with malicious activity. The threat type is specifically credential harvesting, designed to capture sensitive user authentication details for unauthorized access to accounts or systems. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Chengdu West Dimension Digital Technology Co., Ltd. It resolved to the IP address 45.207.199.26, geolocated in Hong Kong under autonomous system AS137899 (I LAYER LIMITED). Detection metrics indicate the domain was flagged by 14 of 95 security vendors on VirusTotal, while appearing on one security blocklist. Google Safe Browsing previously classified the domain as phishing, and no valid SSL certificate was observed during active monitoring. The registrar and hosting provider are consistent with patterns observed in other credential theft campaigns. The domain is currently offline, reducing immediate risk to end users. However, historical activity and infrastructure associations warrant continued vigilance. Organizations and individuals are advised to block the domain and IP address 45.207.199.26 at the network perimeter. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. End users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Proactive threat hunting for indicators of compromise linked to this campaign is recommended.