hexowin167[.]pro

PhishDestroy identifies the domain hexowin167.pro as an active generic phishing threat currently classified at elevated risk. This domain poses as a rewards or incentive platform to harvest user credentials and payment details through deceptive forms. No specific brand impersonation has been confirmed at this stage, but the page structure mimics high-value promotional sites to lure victims. This domain was flagged by 1 of 95 VirusTotal security vendors, indicating limited but credible detection coverage. It was registered through Fewmoretaps OU d/b/a Trustname.com, resolves to IP 188.114.96.3, and was created on March 26, 2026. The site holds a valid Let’s Encrypt SSL certificate, a common tactic to appear legitimate. The low VirusTotal score suggests recent deployment and limited historical analysis. The domain status remains active, and users should avoid interacting with it entirely. Security teams are advised to block the domain hexowin167.pro and IP 188.114.96.3 at the network perimeter. If exposure occurs, users must reset any reused passwords and monitor financial accounts for unauthorized activity. Report this domain to your IT security team or through official phishing reporting channels to help disrupt further campaigns.