mxx66[.]net

mxx66.net is an active domain created on 09 January 2020 via NameCheap, Inc. The authoritative nameservers are kareem.ns.cloudflare.com and katja.ns.cloudflare.com, indicating Cloudflare DNS hosting. DNS resolution returns the Cloudflare edge address 172.65.201.65, which is advertised by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 CA, and HTTP requests receive a 302 redirect response. The visible page title is “ManBetX(万博体育)官网|英超狼队和水晶宫全球赞助伙伴”, which does not reference the claimed target brand. Threat intelligence classifies the domain as a brand‑impersonation campaign targeting Telegram. Gridinsoft assigns a trust score of 0/100. On VirusTotal, 19 of 93 scanning engines flag the domain as malicious. The domain appears on two public blocklists and is listed as blocked by PhishDestroy and PhishingDB. AlienVault OTX records the domain in 16 separate pulses. Detected web technologies include Node.js, Express, jQuery, jQuery UI, HSTS, Google Analytics and GoCache. The combination of a low trust score, multiple vendor detections, blocklist listings, and the explicit brand‑impersonation label suggests a high likelihood of phishing or credential‑harvesting activity. However, the exact content served after the redirect has not been publicly disclosed, leaving the precise lure and credential‑capture mechanisms uncertain. Defenders should block resolution to 172.65.201.65, add the domain to URL filtering rules, and monitor for any traffic toward the Cloudflare edge IP. Incident responders should collect HTTP archives, TLS handshakes, and any payloads observed after the redirect for deeper analysis, and update detection signatures to include the observed page title and the Node.js/Express stack fingerprint.