idexs[.]io

This domain, idexs.io, is flagged as an active cryptocurrency-themed phishing site based on observable technical indicators. Registered on July 18, 2025, through Gname.com Pte. Ltd., the domain currently resolves to IP address 38.60.250.187, hosted under AS138915 (Kaopu Cloud HK Limited) in Germany. The page title, 'IDEX-CRYPTO,' suggests an attempt to impersonate a cryptocurrency exchange or trading platform, though the exact content and target brand remain unverified due to lack of direct analysis. Infrastructure analysis reveals the use of Cloudflare nameservers (felipe.ns.cloudflare.com and mary.ns.cloudflare.com) and SSL certification issued by Google Trust Services (WE1), alongside detected technologies including Vue.js and HTTP/3. The domain is actively blocked by at least one security provider and appears on 23 threat intelligence pulses in AlienVault OTX. VirusTotal reports 9 detections from security vendors, reinforcing its classification as malicious. A 301 HTTP redirect is present, which may indicate an attempt to funnel victims to a secondary malicious endpoint. Defenders should treat this domain as high-risk, particularly in environments involving cryptocurrency transactions or financial services. Immediate blocking at the DNS and network level is recommended, alongside monitoring for related domains using similar naming conventions or infrastructure patterns. Further investigation into associated IP ranges and certificate reuse may uncover additional linked threats.