telowv[.]com

Analysis of telowv.com shows an active generic phishing infrastructure. The web page presents the title "Messenger" and is served over HTTPS with a certificate issued to Telegram and a wildcard *.local name, a mismatch that often indicates misuse of legitimate brand certificates. The domain resolves to IP 27.124.47.186, which GeoIP attributes to Hong Kong and is owned by Rackip Consultancy Pte. LTD. Registration records list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. Threat intelligence sources corroborate malicious activity: AlienVault OTX includes the domain in two separate pulses, and VirusTotal reports that 16 of 91 security vendors have flagged it. The site returns HTTP 200, is currently listed on one security blocklist, and has been blocked by the PhishDestroy feed. While the exact phishing lures or credential‑stealing mechanisms have not been disclosed, the combination of a misleading TLS certificate, active hosting, and multiple vendor detections indicates a high risk to users. Defenders should block DNS resolution for telowv.com, monitor outbound connections to its IP address, and add the domain to email and web filtering policies. Continuous monitoring of the associated IP and any future changes to the hosting environment is recommended to detect potential pivoting or re‑use of the infrastructure.