lixo[.]fi

This domain, lixo.fi, poses a high risk of brand impersonation targeting Google. The domain is designed to deceive users into believing they are interacting with a legitimate Google service, potentially leading to the theft of personal information such as login credentials or financial data.

Analysis indicates that lixo.fi is flagged by 13 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain was created on May 26, 2026, and is registered through Key-Systems GmbH. It appears on 4 security blocklists and has been taken offline. The domain resolves to the IP address 142.251.153.119 and was secured with an SSL certificate from Let's Encrypt, which may have been used to enhance the credibility of the phishing site.

If users visited this domain, they should immediately check their Google accounts for any unauthorized activity. They should also change their passwords and enable two-factor authentication (2FA) for added security. Users are advised to review their recent online activity and monitor their financial statements for any signs of fraud. Reporting the incident to their respective security teams or ISPs is also recommended.