xexz-gx[.]santxye[.]biz[.]id

This domain, xexz-gx.santxye.biz.id, was identified as a credential harvesting phishing site designed to steal login credentials, financial details, or other sensitive information. Such sites typically mimic legitimate services, tricking users into entering personal data that is then captured by threat actors. The presence of an open directory listing (Index of /) suggests poor operational security, often seen in hastily deployed phishing infrastructure, increasing the likelihood of exposure to malicious scripts or additional payloads. Analysis indicates the domain was flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious nature. Registered on March 04, 2026, through PT JC Indonesia, the domain resolved to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. The domain was listed on at least one security blocklist and has since been taken offline, though similar infrastructure may still pose a threat. Users who visited xexz-gx.santxye.biz.id or entered credentials on the site should assume their information has been compromised. Immediately change passwords for any accounts accessed from the same device or network during the exposure period. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor financial statements and credit reports for signs of fraudulent activity. If corporate credentials were exposed, notify the organization’s security team to initiate incident response protocols. Scan the device used to visit the site for malware, as phishing pages may deploy additional threats. Avoid interacting with any communications claiming to be from the site, as follow-up attacks via email or messaging are common.