telewyjb[.]com

Analysis as of July 19, 2026 indicates that telewyjb.com is actively hosting a phishing site. The domain resolves to the IPv4 address 27.124.47.186, which is geolocated to Hong Kong and attributed to Rackip Consultancy Pte. Ltd. Registration records show the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently using the authoritative nameservers ns3.my-ndns.com and ns4.my-ndns.com. An HTTP request returns status 200 and the TLS certificate presented is issued to “Telegram / *.local”, a mismatch that is commonly observed in malicious deployments. The page title returned by the server is “Messenger”, suggesting a possible impersonation of a messaging service, although the exact content of the page has not been disclosed. The domain appears on one public security blocklist and has been flagged by PhishDestroy. Threat intelligence from AlienVault OTX cites the domain in two separate pulses, and VirusTotal reports that six of ninety‑one scanning engines have identified it as malicious. Given the combination of active hosting, mismatched certificate, multiple threat‑intel references, and existing blocklist entries, defenders should add telewyjb.com to network deny‑lists, monitor DNS queries for the domain and its associated IP, and consider sink‑holing the address to capture any attempted connections. Continuous re‑evaluation is advised, as further payload details remain unknown.