lxlis[.]cfd

This domain is flagged as a high-risk generic phishing threat targeting credentials through fake login portals. Analysis indicates the infrastructure is actively maintained despite initial access restrictions, suggesting preparatory staging for malicious campaigns. Infrastructure analysis reveals the domain lxlis.cfd was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.11.233 and presents a 403 Forbidden page title, which may indicate either server misconfiguration or deliberate cloaking of malicious content. The domain appears on one security blocklist, and VirusTotal reports 1 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to phishing sites. Mitigation steps should include immediate blocking of the domain and its associated IP address (104.21.11.233) at the network perimeter. Security teams should monitor for any attempts to access this domain from internal networks, as this may indicate compromised endpoints or phishing attempts. Given the domain's recent creation and active status, organizations should also review logs for any connections to the registrar's infrastructure (NICENIC INTERNATIONAL GROUP CO., LIMITED) or similar high-risk domains. User awareness training should emphasize the risks of entering credentials on unfamiliar login portals, particularly those using recently registered domains or generic top-level domains like .cfd.