ilmxs[.]com

This domain, ilmxs.com, is identified as a credential theft operation targeting software developers and API integrators. Analysis indicates the site masquerades as a legitimate API service portal, using the page title 'New API' to lure victims into submitting authentication credentials. The threat is designed to harvest login details for subsequent unauthorized access to cloud environments, version control systems, or corporate networks, with potential secondary payload delivery for persistent compromise. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through Alibaba Cloud Computing Ltd. (HiChina), an uncommon registrar for legitimate API services. It resolves to IP address 101.201.155.42, hosted on AS37963 (Hangzhou Alibaba Advertising Co., Ltd.) in China. Security vendors have flagged ilmxs.com on VirusTotal with 21 detections out of 95 engines, while two independent blocklists (PhishDestroy and PhishingDB) have listed it as malicious. The SSL certificate, issued by DigiCert's Encryption Everywhere DV TLS CA - G2, provides minimal validation and is commonly abused in phishing infrastructure. Users who visited ilmxs.com or interacted with its content should immediately take containment actions. Reset all credentials entered on the site, particularly API keys, database passwords, and cloud service logins. Conduct a full system scan for malware using updated detection signatures, focusing on browser-based keyloggers or credential dumping tools. Review network logs for connections to 101.201.155.42 or related subdomains of ilmxs.com. Organizations should block the domain and IP at perimeter security controls, and monitor for unauthorized access attempts using the compromised credentials. If the site was accessed from corporate devices, initiate an incident response procedure to assess potential lateral movement or data exfiltration.