tqxxbymem[.]com

Analysis of www.tqxxbymem.com as of 13 July 2026 indicates that the domain is actively being used for a generic phishing campaign and is classified as high risk. The domain was registered on 12 March 2026 through Amazon Registrar, Inc. and is hosted on IP 43.175.162.104, which resolves to an autonomous system (AS139341) associated with ACE in Germany. DNS is served by four AWS name servers (ns-1469.awsdns-55.org, ns-1723.awsdns-23.co.uk, ns-472.awsdns-59.com, ns-845.awsdns). The site presents a 403 Forbidden HTTP status and advertises HTTP/3 support. The SSL certificate is issued by DigiCert Inc under the GeoTrust TLS RSA CA G1 chain, confirming the presence of a valid TLS certificate. Reputation scoring from Gridinsoft assigns a score of 0 out of 100, and the domain appears on a single security blocklist. One of ninety‑four VirusTotal scanners has flagged the domain, and it is already blocked by the PhishDestroy mitigation service. No content beyond the 403 title has been observed, so the exact phishing payload or credential‑harvesting page cannot be confirmed. Defenders should treat the domain as malicious, enforce outbound DNS filtering to block resolution, add the IP address to network‑level deny lists, and consider sinkholing the domain to disrupt possible command‑and‑control traffic. Continuous monitoring of the associated IP range and ASN for new activity is advised, as is periodic re‑scan with multi‑engine services to detect any changes in the payload or hosting configuration.