lexoindex-de[.]net

lexoindex-de.net was registered on 24 February 2026. Within weeks the domain began appearing in multiple security blocklists and was subsequently taken offline. VirusTotal records indicate that ten of ninety‑three scanning engines flagged the domain as malicious, suggesting a detection confidence that exceeds baseline noise. The site was served over HTTPS using a certificate identified only as “E8”, and the Gridinsoft trust score assigned a value of 0 out of 100, reflecting a complete lack of trust.

Hosting analysis shows the domain resolved to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The IP itself is shared across many unrelated services, but the association with Cloudflare does not mitigate the observed malicious indicators. The domain is listed on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, reinforcing the conclusion that it was used for phishing‑related activity. At the time of reporting (24 July 2026) the domain is offline, and no HTTP response body or page title has been captured, leaving the exact phishing payload or targeted brand undefined.

The limited evidence therefore points to a short‑lived, high‑risk phishing infrastructure that was quickly disrupted. Defenders should continue to block the host IP, add lexoindex‑de.net to internal deny lists, and monitor for re‑registration or similar aliases that resolve to the same Cloudflare IP range. Ongoing threat‑intel feeds should be consulted for any resurgence, and any future DNS queries for the domain should be logged for correlation with credential‑theft attempts.