lexzx[.]com

Analysis of lexzx.com indicates a high‑risk brand‑impersonation campaign targeting Telegram users. The site is registered through Gname.com Pte. Ltd. and was created on June 06, 2014. It resolves to the IP address 45.135.237.29, which belongs to OWGELS INTERNATIONAL CO., LIMITED in Hong Kong (AS153656). No SSL certificate is present, and HTTP requests to the host return an offline status at the time of assessment. The authoritative nameservers are a.share-dns.com, a6.share-dns.com, b.share-dns.net, and b6.share-dns.net.

Google Safe Browsing flags the domain for social engineering, aligning with the observed scam type of social media phishing. VirusTotal records show that 17 of 93 security vendors have flagged the domain, reinforcing its malicious reputation. AlienVault OTX lists the domain in six separate threat intelligence pulses, and it appears on one additional security blocklist. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy reports the site as blocked. The page title returned from the host is "TK Store | buy, sell and discover on TK," which does not directly reference Telegram but is consistent with the use of generic e‑commerce wording often employed in phishing lures.

The campaign explicitly impersonates Telegram, suggesting that any credential‑capture pages would be designed to harvest Telegram login data. Because the site is currently offline, direct observation of the phishing page content is not possible, leaving the exact user‑experience unknown. Defenders should continue to block lexzx.com at network perimeter and DNS layers, monitor for any re‑appearance of the domain or related IP addresses, and add the domain to internal threat‑intel feeds. Given the combination of multiple vendor detections, blocklist entries, and the low trust score, the domain should be treated as malicious and excluded from user access.