filightersdex[.]xyz

The domain www.filightersdex.xyz was registered on February 21, 2026 through Global Domain Group LLC and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 65.21.174.205, which belongs to Hetzner Online GmbH (AS24940) in Finland. The host is served by the nameservers ns41.link-host.net and ns42.link-host.net. No SSL certificate was observed, indicating that the site does not provide encrypted transport.

The page title returned from the live endpoint was "Exchange System Architecture Overview," a generic title that offers no direct indication of the targeted brand or service. Trust scoring from Gridinsoft assigned a zero out of one hundred, reflecting an extremely low reputation. The domain has been blocked by the PhishDestroy service and appears on one external blocklist, confirming that defensive feeds are already flagging it. VirusTotal scans reported six detections out of ninety‑three security vendors, reinforcing the malicious assessment.

AlienVault OTX references the domain in a single threat‑intel pulse, providing additional corroboration. Because the site is offline, active payload capture is not possible, but the combination of a low trust score, lack of TLS, multiple detections, and blocklist presence suggests a classic credential‑harvesting operation. Defenders should continue to deny any network traffic to 65.21.174.205, add www.filightersdex.xyz to URL filtering and DNS sinkhole lists, and monitor for any resurgence of the domain or associated IP ranges. Continued observation of the registrar and nameserver changes is advised, as threat actors often repurpose similar infrastructure for future campaigns.