phaexnt[.]info

PhishDestroy identifies phaexnt.info as an active fake login phishing domain impersonating a major brand’s authentication portal to harvest login credentials and session tokens. The campaign is currently live and distributing malicious links via targeted emails and social engineering tactics. This domain was first registered on March 23, 2026, and has since been associated with active phishing operations designed to deceive users into surrendering sensitive account credentials. PhishDestroy confirms that phaexnt.info has been flagged by 2 of 95 VirusTotal security vendors and appears on one external blocklist. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 162.241.85.94. The site is secured with a Let’s Encrypt SSL certificate, a common tactic used to enhance perceived legitimacy. Despite its recent registration date, the domain exhibits behavioral patterns consistent with credential harvesting operations. This domain is actively blocked by InversionDNS and remains classified as an elevated threat due to the likelihood of credential compromise. Users are strongly advised to avoid interacting with phaexnt.info and verify any suspicious links using PhishDestroy’s real-time scanner. Organizations should update network blocklists to include this domain and its associated IP (162.241.85.94) to prevent accidental exposure. If credentials have already been entered, users should immediately rotate passwords, enable multifactor authentication, and monitor accounts for suspicious activity.