telewlvl[.]com

Analysis indicates that the domain telewlvl.com is currently active and hosts a webpage titled “Messenger”. The site presents an SSL certificate issued to “Telegram / *.local”, which is inconsistent with the domain name and suggests an attempt to masquerade as a legitimate messaging service. Registration information shows the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. DNS resolution points to IP 27.124.47.186, an address hosted in Hong Kong and associated with Rackip Consultancy Pte. LTD. HTTP requests return a 200 status code, confirming that the site is reachable. Threat intelligence feeds have flagged the domain as high‑risk phishing; ten of ninety‑one VirusTotal scanners have reported malicious behavior, and it appears on a single external blocklist. The domain is also listed by PhishDestroy as blocked, though the site remains reachable. At present, no additional details about the content of the page or its payload have been disclosed, leaving the exact phishing vector uncertain. Defensive recommendations include adding the IP address and domain to network deny lists, enforcing TLS inspection to detect the mismatched certificate, and monitoring for any credential‑harvesting traffic targeting users of the Telegram service. Continuous re‑evaluation is advised as additional detections may emerge.