lootix[.]life

This domain, lootix.life, is actively engaged in credential harvesting through phishing pages designed to mimic legitimate login portals. Analysis indicates the site presents a deceptive interface under the page title 'Loading,' suggesting an in-progress attack chain intended to capture user credentials, payment details, or other sensitive information. The infrastructure is optimized for rapid deployment and evasion, with minimal initial content to avoid automated detection during early scanning phases. Infrastructure analysis reveals the domain was registered on April 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious registrations. The domain resolves to IP address 91.227.114.14, hosted in Germany by Xantho UAB, a provider commonly linked to phishing and malware distribution. Security vendor detection on VirusTotal shows 4 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E7), provides encrypted communication, further legitimizing the site to potential victims. Users who have visited lootix.life should immediately terminate any active sessions and avoid entering credentials or personal information. If credentials were submitted, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. System logs should be reviewed for connections to 91.227.114.14 or the domain itself, and any suspicious activity reported to internal security teams. Network-level blocking of the domain and associated IP is recommended to prevent further exposure within organizational environments.