tejegvhxol[.]top

The domain tejegvhxol.top was registered on March 28, 2026 through the registrar 成都西维数码科技有限公司. DNS resolution points to the IP address 188.114.96.3, which is owned by CloudFlare, Inc. and geolocated to Canada. The domain is served by Cloudflare name servers jonah.ns.cloudflare.com and novalee.ns.cloudflare.com, and presents an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS connection despite the underlying malicious activity. HTTP requests to the host return a 403 status code, and the domain has been taken offline at the time of analysis, though historical evidence suggests active malicious use.

Google Safe Browsing classifies the site as a social engineering threat, and VirusTotal reports that 21 of 94 security vendors have flagged the domain as malicious, providing a strong consensus of risk. AlienVault Open Threat Exchange lists the domain in a single threat‑intelligence pulse, and it appears on one public blocklist, further confirming its involvement in malicious operations. The anti‑phishing service PhishDestroy has also added the domain to its blocklist. Although the specific phishing lures, page content, or targeted brands have not been publicly disclosed, the convergence of multiple independent detections, the presence of a valid SSL certificate, and the use of Cloudflare infrastructure are typical of credential‑harvesting campaigns that rely on trusted TLS to bypass user suspicion.

Defenders should immediately block tejegvhxol.top at the DNS and proxy layers, enforce outbound traffic filters to the associated IP 188.114.96.3, and monitor for any residual traffic or credential submissions that may have been captured before the takedown. Continuous monitoring of Cloudflare‑originating IP ranges for anomalous activity is advisable, as attackers may repurpose the same infrastructure for future campaigns.