lyxenar[.]com

This domain, lyxenar.com, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (AS13335) at the IP address 188.114.97.3. The authoritative nameservers are lochlan.ns.cloudflare.com and raina.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns the generic page title “Just a moment…”, indicating that the site is serving a placeholder page rather than a fully crafted phishing landing page. VirusTotal analysis shows that six of ninety‑five scanned security vendors flagged the domain, suggesting a moderate level of malicious confidence. The domain appears on one external blocklist and is explicitly listed by the PhishDestroy feed, confirming that it has been identified as a phishing resource by at least one reputable sink‑hole. Gridinsoft assigns a trust score of 1 out of 100, reinforcing the low credibility of the site.

The current status is offline, which may be the result of takedown actions or temporary hosting changes. Evidence is limited to infrastructure and reputation data; no payload, credential‑harvesting form, or targeted brand information has been disclosed. Consequently, the exact phishing campaign vector and intended victims remain uncertain. The lack of an SSL certificate means that any data submitted would be transmitted in clear text, a typical characteristic of low‑effort phishing infrastructures. Because the domain resolves to a shared Cloudflare IP, attribution to a single operator is difficult, and the same IP may host unrelated benign sites. The presence on only one blocklist suggests limited exposure so far, but the six vendor detections indicate that the domain has been observed in phishing traffic.

Threat intelligence teams should correlate this indicator with recent phishing email campaigns to determine if lyxenar.com is being used as a redirect or drop‑site. Defenders should continue to block lyxenar.