indexiplex200[.]com

PhishDestroy identifies indexiplex200.com as a newly active crypto credential theft domain leveraging a generic phishing lure. The domain, registered on March 22, 2026 through Fewmoretaps OU (d/b/a Trustname.com), resolves to 104.21.89.125 and currently operates without antivirus detection, as evidenced by 0 detections out of 95 engines on VirusTotal. The presence of a Let’s Encrypt SSL certificate suggests an attempt to appear legitimate, while the recent registration timeline and anonymous registrar raise concerns about its intended use in fraudulent activities. This domain poses a direct threat to cryptocurrency users by masquerading as a legitimate service to harvest login credentials or private keys. The low detection rate—1/95 on VirusTotal at the time of analysis—indicates that this domain has not yet been widely flagged by security vendors, potentially allowing it to evade immediate blocking. The infrastructure, including the IP address 104.21.89.125, has not been previously associated with known malicious campaigns in open-source threat intelligence, suggesting a potentially opportunistic or emerging threat actor. The use of a generic name and recently issued SSL certificate further supports the hypothesis that this domain is part of a broader credential harvesting campaign targeting less security-aware users. Users who have visited indexiplex200.com should immediately audit any cryptocurrency wallets or exchange accounts accessed from the same browser or device. Revoke any saved sessions or API keys associated with the domain, and consider transferring funds to a new wallet with a freshly generated seed phrase. Enable multi-factor authentication on all crypto-related accounts and monitor for unauthorized transactions. Report the domain to your security team or threat intelligence platforms to aid in blocking and further analysis. If credentials were entered, assume compromise and rotate passwords and private keys immediately.