xxyez-ld[.]nxtxle[.]biz[.]id

This domain, xxyez-ld.nxtxle.biz.id, is identified as a fraudulent customer support phishing site designed to impersonate legitimate financial service portals. The page title, "𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔," suggests an attempt to mimic a trusted financial institution, likely targeting users seeking assistance with accounts or transactions. Such phishing sites typically aim to harvest login credentials, personal identification details, or financial information under the guise of providing customer support. The use of stylized text in the page title may be intended to evade basic text-based detection mechanisms while maintaining visual similarity to authentic branding. Analysis of the domain’s infrastructure reveals multiple technical indicators of malicious activity. The domain resolves to the IP address 188.114.97.3, which is associated with a content delivery network and hosted under AS13335, a known provider frequently utilized by threat actors to obfuscate origins. It was registered through PT JC Indonesia on March 04, 2026, indicating a recently established domain likely created for short-term malicious use. The domain appears on one security blocklist and is flagged by 22 out of 95 security vendors on a widely used threat intelligence platform, further corroborating its classification as a phishing threat. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites commonly employ valid certificates to appear legitimate. Users who have visited xxyez-ld.nxtxle.biz.id or interacted with its content should take immediate remedial actions to mitigate potential risks. Any credentials, personal information, or financial details entered on the site should be considered compromised and must be changed without delay. Affected users are advised to monitor their financial accounts for unauthorized transactions and enable multi-factor authentication on all critical services. If the site was accessed via a corporate or institutional network, the incident should be reported to the relevant security team for further investigation. Additionally, users should verify the authenticity of any communications claiming to be from the impersonated financial institution and avoid clicking on links from untrusted sources.