tyxe[.]biz[.]id

The domain tyxe.biz.id has been confirmed as a credential theft phishing site, designed to deceive users into submitting login credentials through fraudulent web forms. Analysis indicates the infrastructure was actively harvesting sensitive information, including usernames, passwords, and potentially multi-factor authentication codes. The domain is currently offline, but prior activity suggests it was operational for a limited period before detection and takedown. Infrastructure analysis reveals the domain was registered on March 04, 2026, through PT JC Indonesia, an uncommon registrar for phishing campaigns. It resolved to the IP address 172.67.177.144, hosted on Cloudflare’s network (AS13335), a frequent choice for threat actors due to its proxy services and geographic distribution. The SSL certificate was issued by Google Trust Services (WE1), a legitimate provider often exploited to lend credibility to malicious sites. At the time of assessment, 21 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The page title, '500 Proxy Error,' suggests either a misconfiguration or an attempt to evade automated detection by presenting as a broken or benign resource. Current status indicates the domain has been taken offline, likely due to enforcement actions or abandonment by the threat actor. However, the infrastructure may resurface under a different domain or IP address. Organizations and individuals are advised to block the domain and its associated IP (172.67.177.144) at the network level. Users who may have interacted with the site should immediately reset credentials for any accounts entered on the page, enable multi-factor authentication where available, and monitor for unauthorized access. Security teams should review logs for connections to the domain or IP, particularly from endpoints that may have bypassed existing controls.