# PhishDestroy domain threat record: miolex.win Content language: English Canonical HTML report: https://phishdestroy.io/domain/miolex.win/ Machine-readable companion: https://phishdestroy.io/domain/miolex.win/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-06 04:12:36 UTC - Last availability or vendor check: 2026-10-21 01:15:02 UTC - Stored record updated: 2026-10-22 14:23:24 UTC - VirusTotal detections in the stored snapshot: 14/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Cloudflare ## Stored infrastructure - Observed IP address: 104.21.43.127 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 403 - Registration date (registry RDAP, miolex.win): 2026-03-09 18:25:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a074ea-2ff3-776a-b157-977475772ba8/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/miolex.win - Certificate Transparency search: https://crt.sh/?q=%25.miolex.win - Web Archive lookup: https://web.archive.org/web/*/https://miolex.win/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview miolex.win is an impersonation phishing site that borrows Cloudflare's name and look, with content scanners also tagging it as a generic crypto scam. Its likely targets are crypto holders who treat a Cloudflare-style screen as a routine security step. PhishDestroy first saw it on 2026-09-06. The site has been offline since 2026-09-11, and its content was still blocked by the hosting provider at the last check on 2026-10-19. How the scam works The page title reads "Suspected Phishing | Cloudflare", which matches the warning Cloudflare displays on flagged sites, while we classified the domain itself as a Cloudflare impersonation page. Fake security or verification screens of this kind rely on borrowed trust: the visitor assumes the page is a legitimate checkpoint and follows its prompts. In crypto-themed versions, those prompts usually ask the visitor to enter wallet details, connect a wallet, or approve an action. Anyone who complies can lose credentials or funds to the operator. Evidence On 2026-09-16, 14 of 89 VirusTotal engines flagged the domain. The vendors included alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker and Fortinet. Agreement among that many independent vendors makes a false positive unlikely. urlscan.io returned a malicious verdict and identified generic crypto and crypto-scam patterns. The domain also appears in four AlienVault OTX threat pulses and on the PhishDestroy blocklist. Infrastructure The domain was registered on 2026-03-09, roughly six months before PhishDestroy detected it. That gap suggests it was registered in advance or sat unused before going live. It sat behind Cloudflare's network in the US at 104.21.43.127. This means the visible address belongs to Cloudflare's proxy and not to the operator's own server. Cloudflare has since blocked the content. What to do If you entered a password or recovery phrase on this site, treat it as compromised. Move any funds to a new wallet created from a fresh seed, then change the affected passwords and turn on two-factor authentication. If you connected a wallet or signed anything, review and revoke token approvals with a revocation tool, and watch for unexpected transfers. Defenders should block miolex.win at DNS and proxy level and search logs for any visits since 2026-09-06. Treat Cloudflare-branded "verification" pages on unfamiliar domains as suspect. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a074ea-2ff3-776a-b157-977475772ba8/ VirusTotal report: https://www.virustotal.com/gui/domain/miolex.win Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=miolex.win Archived copy: https://web.archive.org/web/20260906041723/https://miolex.win/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:22:23 UTC ## Stored page captures - Primary capture: https://i.ibb.co/dwrLypPD/eae889686b6c.png Captured: 2026-09-06 04:12:36 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a074ea-2ff3-776a-b157-977475772ba8.png Captured: 2026-09-06 04:12:36 UTC Source report: https://urlscan.io/result/01a074ea-2ff3-776a-b157-977475772ba8/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7028dcdb-4458-4786-9758-a5e87b5c242d.png Captured: 2026-09-06 04:20:19 UTC Source report: https://radar.cloudflare.com/scan/7028dcdb-4458-4786-9758-a5e87b5c242d SHA-256: 1458ee287b09a45e019c8ad36413897cbe174c9f02a04c18aef8a47ee7bdb6e3 - URLScan ยท 2026-09-06: https://screenshots.phishdestroy.io/us/01a074eb-1cfa-76c9-a497-15dc623f4a57.png Captured: 2026-09-06 04:12:48 UTC Source report: https://urlscan.io/result/01a074eb-1cfa-76c9-a497-15dc623f4a57/ SHA-256: e501aa2c6e8a8f17ca0d323b9fbbf39a007883040e07bfaa008047c476e922da ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:24:10Z", "uuid": "01a074ea-2ff3-776a-b157-977475772ba8", "scanned_at": "2026-09-06T04:11:46Z", "final_url": "https://miolex.win/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://miolex.win/", "from": "http://miolex.win/", "status": 307 } ], "ip": "172.67.179.135", "domains": [ "static.ads-twitter.com", "connect.facebook.net" ], "ips": [ "146.75.120.157", "157.240.0.6", "172.67.179.135" ], "asns": [ "54113", "32934", "13335" ], "countries": [ "DE" ], "doc_hash": "b13b0d9f395ff593615f124a04bfff436d628debc1b00df06a79a0f38839cd47", "script_hashes": [ "d872665bddf3245bfbdfa8b534199f4e10ac5e4cf2952b4c8adaef5ccfafa881", "e5b9e2570593ab1e59ae6a397baec8491e4c3d5e4628aa1439940ac0e2aee2fe", "d3844f2db215d099728ef83a3b5cb3cb82279b669b231f54d2cdbbd958949f1d", "90a949795e63ad10200d2f57df2706979fd66bd412caea2130a9c707e21c5d5b", "dccd0125f7ca7c6c5f3f8ae7d813743257cb55899fcab2d63b70fdf06b2a05e2", "4974bda3ce7194ae592697daaccd424e6e8e231bf15187182bf4d16522e9bffb", "a80e2f887fe98f5dd1f607d951147f5de620031519c6419ed1fb86e7b6621686", "a426cf8287fcc2840e0778679b093e282896cf2ae79d818d323ca3a243505092", "3513d69dd757c29044eb92ab6a908ba6755e0845c38105ab2e196b0c75b96583", "237ff25124f0ca73e06c9e1d59caadd016273fa9b5b6bf211c991cc8d34d1b92" ], "globals": [ "__next_f", "webpackChunk_N_E", "next", "_N_E_STYLE_LOAD", "__core-js_shared__", "HowlerGlobal", "Howler", "Howl", "Sound", "fbq", "_fbq", "twq", "loadTtq", "mb_setLanguage", "mb_lang", "twttr", "mb_openLangModal" ], "tls": { "san": [ "*.miolex.win", "miolex.win" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "miolex.win", "protocol": "TLS 1.3", "valid_to": "2026-12-01T16:21:56Z", "valid_from": "2026-09-02T16:21:57Z" }, "domain_age_days": 180, "apex_age_days": 180, "tls_age_days": 3, "tls_valid_days": 89, "requests": 79, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto", "cryptoscam" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto", "Crypto Scam" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:59:30Z", "uuid": "7028dcdb-4458-4786-9758-a5e87b5c242d", "scanned_at": "2026-09-06T04:20:19Z", "final_url": "https://miolex.win/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://miolex.win/", "status": 307 }, { "url": "https://miolex.win/", "status": 200 } ], "dom_hash": "15a1b5e13cc06d760586917fb517bd4ce2e249ba53bd55653e430ed01729bb30", "doc_hash": "b13b0d9f395ff593615f124a04bfff436d628debc1b00df06a79a0f38839cd47", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "miolex.win", "type": "A", "value": "104.21.43.127" }, { "name": "miolex.win", "type": "A", "value": "172.67.179.135" } ], "dnssec_valid": false, "ip": "104.21.43.127", "whois": { "registrar": "Gname.com Pte. Ltd.", "created": "2026-03-09T18:25:39Z", "updated": "2026-05-08T18:25:43Z", "expires": "2027-03-09T18:25:39Z", "nameservers": [ "aarav.ns.cloudflare.com", "gracie.ns.cloudflare.com" ] } } } ```