lefox.sh was registered with NameCheap, Inc. on 18 Mar 2024. Its SSL certificate from Let's Encrypt expired on 16 Jun 2024.
What security vendors and the WOT community say about this domain.
What loads and tracks visitors when the homepage opens.
Running a full browser scan of the homepage… This takes about a minute.
294 similar domains registered in the last 90 days — possible typosquatting or phishing.
| Domain | Why it’s similar | Registered | Status | Report |
|---|---|---|---|---|
| lefox.cn | Other extension | 22 Sept 2026 | Checking… | Report → |
| elfox.pro | Typo | 11 Sept 2026 | Checking… | Report → |
| lefix.cn | Typo | 8 Nov 2026 | Checking… | Report → |
| lerox.com.tr | Typo | 31 Oct 2026 | Checking… | Report → |
| legox.xyz | Typo | 4 Oct 2026 | Checking… | Report → |
From CubDomain's daily newly registered domains. Similar doesn't mean malicious.
Is lefox.sh’s name taken on other extensions?
1 technology detected across 1 category.
Detected from headers, page source and DNS · Automatic and may be incomplete · Suggest a correction
Every IP address lefox.sh resolves to, and where it's hosted.
| Host | IPv4 address | TTL |
|---|---|---|
| lefox.sh | 104.21.5.120 | 300 |
| lefox.sh | 172.67.133.99 | 300 |
| Host | IPv6 address | TTL |
|---|---|---|
| lefox.sh | 2606:4700:3035::6815:578 | 300 |
| lefox.sh | 2606:4700:3036::ac43:8563 | 300 |
| Host | Name server | TTL |
|---|---|---|
| lefox.sh | adi.ns.cloudflare.com | 21600 |
| lefox.sh | nile.ns.cloudflare.com | 21600 |
| Host | Start of authority | TTL |
|---|---|---|
| lefox.sh | adi.ns.cloudflare.com dns.cloudflare.com 2336527173 10000 2400 604800 1800 | 1800 |
Other domains served from 104.21.5.120. Normal for shared hosting and CDNs.
No reviews yet. Used lefox.sh? Be the first to say how it went.
Reviews are from CubDomain users and are separate from the security verdicts above.
Common questions, answered from this report's data.
lefox.sh has no community safety rating yet. Its SSL certificate expired on 16 Jun 2024. See Security →
lefox.sh is registered through NameCheap, Inc. The owner's details are hidden by a privacy service in the public WHOIS record. See WHOIS →
The registration expired on 18 Mar 2025. See Overview →
lefox.sh was registered on 18 Mar 2024, making it 2 years old. See Overview →
lefox.sh is served from 2 IP addresses, mainly on AS13335. See Hosting →
We detected 1 technology, including Bootstrap CDN. See Built with →
Raw registry data for lefox.sh. May be redacted by privacy services.
Domain Name: lefox.sh Registry Domain ID: ad5910eaebfb4a1d8fba53199eaee25c-DONUTS Registrar WHOIS Server: whois.namecheap.com Registrar URL: https://www.namecheap.com/ Updated Date: 2024-03-18T18:46:10Z Creation Date: 2024-03-18T18:43:19Z Registry Expiry Date: 2025-03-18T18:43:19Z Registrar: NameCheap, Inc. Registrar IANA ID: 1068 Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +1.9854014545 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: addPeriod https://icann.org/epp#addPeriod Registry Registrant ID: REDACTED FOR PRIVACY Registrant Name: REDACTED FOR PRIVACY Registrant Organization: Privacy service provided by Withheld for Privacy ehf Registrant Street: REDACTED FOR PRIVACY Registrant City: REDACTED FOR PRIVACY Registrant State/Province: Capital Region Registrant Postal Code: REDACTED FOR PRIVACY Registrant Country: IS Registrant Phone: REDACTED FOR PRIVACY Registrant Phone Ext: REDACTED FOR PRIVACY Registrant Fax: REDACTED FOR PRIVACY Registrant Fax Ext: REDACTED FOR PRIVACY Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name. Registry Admin ID: REDACTED FOR PRIVACY Admin Name: REDACTED FOR PRIVACY Admin Organization: REDACTED FOR PRIVACY Admin Street: REDACTED FOR PRIVACY Admin City: REDACTED FOR PRIVACY Admin State/Province: REDACTED FOR PRIVACY Admin Postal Code: REDACTED FOR PRIVACY Admin Country: REDACTED FOR PRIVACY Admin Phone: REDACTED FOR PRIVACY Admin Phone Ext: REDACTED FOR PRIVACY Admin Fax: REDACTED FOR PRIVACY Admin Fax Ext: REDACTED FOR PRIVACY Admin Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name. Registry Tech ID: REDACTED FOR PRIVACY Tech Name: REDACTED FOR PRIVACY Tech Organization: REDACTED FOR PRIVACY Tech Street: REDACTED FOR PRIVACY Tech City: REDACTED FOR PRIVACY Tech State/Province: REDACTED FOR PRIVACY Tech Postal Code: REDACTED FOR PRIVACY Tech Country: REDACTED FOR PRIVACY Tech Phone: REDACTED FOR PRIVACY Tech Phone Ext: REDACTED FOR PRIVACY Tech Fax: REDACTED FOR PRIVACY Tech Fax Ext: REDACTED FOR PRIVACY Tech Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name. Name Server: adi.ns.cloudflare.com Name Server: nile.ns.cloudflare.com DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/ >>> Last update of WHOIS database: 2024-03-22T04:00:06Z <<< For more information on Whois status codes, please visit https://icann.org/epp Terms of Use: Access to WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the registry database. The data in this record is provided by Identity Digital or the Registry Operator for informational purposes only, and accuracy is not guaranteed. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator, a Registrar, or Identity Digital except as reasonably necessary to register domain names or modify existing registrations. When using the Whois service, please consider the following: The Whois service is not a replacement for standard EPP commands to the SRS service. Whois is not considered authoritative for registered domain objects. The Whois service may be scheduled for downtime during production or OT&E maintenance periods. Queries to the Whois services are throttled. If too many queries are received from a single IP address within a specified time, the service will begin to reject further queries for a period of time to prevent disruption of Whois service access. Abuse of the Whois system through data mining is mitigated by detecting and limiting bulk query access from single sources. Where applicable, the presence of a [Non-Public Data] tag indicates that such data is not made publicly available due to applicable data privacy laws or requirements. Should you wish to contact the registrant, please refer to the Whois records available through the registrar URL listed above. Access to non-public data may be provided, upon request, where it can be reasonably confirmed that the requester holds a specific legitimate interest and a proper legal basis for accessing the withheld data. Access to this data provided by Identity Digital can be requested by submitting a request via the form found at https://www.identity.digital/about/policies/whois-layered-access/. The Registrar of Record identified in this output may have an RDDS service that can be queried for additional information on how to contact the Registrant, Admin, or Tech contact of the queried domain name. Identity Digital Inc. and Registry Operator reserve the right to modify these terms at any time. By submitting this query, you agree to abide by this policy.
Four timed TCP connections to port 443 from CubDomain's servers.
CubDomain is not affiliated with lefox.sh. Data is collected independently from public sources and some figures are estimates, provided for information only.
Spam and malware blocklists for the site's IP and mail servers.
Found in public certificate transparency logs.
Searching the certificate transparency logs… This can take up to a minute.
When the site first appeared, and what has changed since.
We record what changes from the next time this report is refreshed.