igxe1[.]com

The domain igxe1.com returned an HTTP 200 response and presents a page titled "igxe1.com｜igxe（IGXE）与 CS2 饰品中文指南站". The site is currently active and has been flagged by the PhishDestroy blocklist, indicating that it is being used in a phishing campaign. The page’s content appears to target users interested in CS2 in‑game items, leveraging the familiar branding of IGXE to lure victims.

Infrastructure analysis shows the domain is hosted behind Cloudflare, resolving to IP address 104.21.12.232 located in Canada. Authoritative name servers are abby.ns.cloudflare.com and leo.ns.cloudflare.com, both Cloudflare managed. The TLS certificate is issued by Let’s Encrypt (E7), confirming the use of a free, automated certificate. Registration was performed on April 24 2026 through Fewmoretaps OU d/b/a Trustname.com, and the domain has a Gridinsoft trust score of 0 out of 100. It appears on a single security blocklist and has been referenced in one AlienVault OTX pulse, suggesting limited but targeted intelligence sharing.

Based on the observed characteristics—valid SSL, Cloudflare front‑end, recent registration, low trust score, and blocklist inclusion—the domain aligns with the generic_phishing threat type. The lack of detections on VirusTotal (0/95) does not constitute evidence of benign intent; many phishing sites evade automated scanning. Uncertainty remains regarding the exact payload or credential harvesting mechanisms employed, as no malware signatures have been reported.

Defenders should treat igxe1.com as a malicious phishing vector. Recommended actions include adding the domain to URL filtering and DNS blocklists, monitoring for related traffic to the Cloudflare IP, and applying email gateway rules that detect and quarantine messages containing the domain or its page title. Continuous threat intel updates are advised to capture any emerging indicators that may expand the scope of the campaign.