lokadex[.]com

Analysis of lokadex.com indicates a confirmed phishing domain targeting Apple users, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to 172.67.218.156, a Cloudflare IP (AS13335) located in the US. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'Cryptocurrency Exchange | Buy cryptocurrency on LOKADEX,' suggests an attempt to lure victims under the guise of a crypto-related service, though the exact content and mechanics of the phishing scheme remain unconfirmed due to the domain's offline status.

Infrastructure analysis reveals Cloudflare nameservers (adrian.ns.cloudflare.com, johnathan.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 5 of 93 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The scam type is identified as social media phishing, though specific vectors (e.g., fake login portals, fraudulent promotions) are not detailed in available intelligence.

Defenders should treat this domain as a high-confidence threat. Recommended actions include blocking the domain and IP at the perimeter, monitoring for related subdomains or newly registered lookalike domains, and alerting users to potential Apple-branded phishing attempts, particularly those involving cryptocurrency lures. Given the domain's current offline status, continuous monitoring for reactivation or shifts in infrastructure is advised. No evidence links this domain to a known phishing kit, so kit-specific signatures should not be assumed without further analysis.