lxx-ld[.]tyxe[.]biz[.]id

This domain, lxx-ld.tyxe.biz.id, is identified as a credential harvesting phishing infrastructure designed to deceive users into submitting sensitive authentication credentials. Analysis indicates the site employs a 500 Proxy Error page as a deceptive front, likely intended to mimic legitimate service disruptions while harvesting entered credentials through concealed input fields or redirect chains. The threat specifically targets users attempting to access spoofed login portals, where submitted data is exfiltrated to attacker-controlled servers. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 104.21.56.48, hosted on Cloudflare's network (AS13335), a common tactic to obscure backend infrastructure. It was registered through PT JC Indonesia on March 04, 2026, with an anomalous future creation date suggesting potential domain spoofing or registry manipulation. Detection metrics show 21 out of 95 security engines on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides nominal encryption but does not mitigate the underlying phishing threat. Users who visited lxx-ld.tyxe.biz.id should immediately revoke any entered credentials, particularly for financial or corporate services. Reset passwords using multi-factor authentication where available, and monitor associated accounts for unauthorized activity. Network administrators should block the domain and IP 104.21.56.48 at perimeter defenses, while endpoint protection systems should be updated to include this indicator of compromise. The anomalous 2026 creation date warrants additional scrutiny of domain registration patterns for related phishing infrastructure.