lexidexti[.]com

Lexidexti.com was registered on 2026-03-06 through GoDaddy.com, LLC and immediately pointed to the Cloudflare edge address 104.21.11.163 (AS13335, United States). The authoritative name servers listed are grannbo.ns.cloudflare.com and noah.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS and CDN services. An SSL certificate issued by Let’s Encrypt (E8) secures the HTTPS endpoint, but an HTTP 403 response is returned for standard requests, suggesting the site was deliberately taken offline or is restricting access. The page title observed before takedown reads “Lexidexti — Secure Cryptocurrency Trading Platform,” and the campaign has been classified as a “Fake Exchange” under the generic phishing category.

The domain appears on one security blocklist and has been actively blocked by the PhishDestroy sinkhole. VirusTotal analysis shows that 2 of 94 scanning engines flagged the domain, providing limited but notable detection. At the time of reporting (2026-07-25) the site is marked offline, limiting immediate interaction but preserving forensic evidence of its infrastructure. The available data confirms the use of reputable hosting (Cloudflare) to mask malicious activity, a common tactic for phishing operators seeking to benefit from Cloudflare’s reputation and DDoS protection.

The presence of a legitimate‑sounding page title and a TLS certificate may increase user trust, while the 403 status suggests the operators have either ceased activity or are employing a kill‑switch. No additional indicators such as malware hashes, payload URLs, or compromised credentials have been disclosed, leaving the full scope of the campaign uncertain. Defenders should add 104.21.11.163 and the domain lexidexti.com to network‑level blocklists, monitor for any resurgence of the domain or related sub‑domains, and continue to share this indicator set with threat‑intel platforms.