fxempire[.]es

On 26 July 2026 analysts observed the domain fxempire.es listed on a single security blocklist and actively blocked by the PhishDestroy service. The HTTP response for the root URL is a 301 redirect, indicating that the site returns a permanent move status rather than delivering content directly. A VirusTotal scan submitted the domain to 91 anti‑malware engines; none of the engines reported a detection at the time of analysis. The absence of detections does not constitute a safety guarantee, as the domain remains classified as a generic phishing site and its risk level is marked “under investigation.” The domain’s current operational status is active, meaning the infrastructure is still reachable and may be used in credential‑harvesting campaigns.

Available intelligence does not include registrar details, IP address, autonomous system number, hosting provider, SSL certificate information, or Safe Browsing identifiers, so the underlying hosting environment cannot be profiled at this stage. Likewise, no page title, brand references, or phishing kit signatures have been published, limiting the ability to attribute the site to a specific campaign or threat actor. Consequently, the primary evidence for the threat assessment consists of the blocklist entry, the PhishDestroy block action, the HTTP 301 response, and the VirusTotal scan results. The single blocklist listing suggests limited exposure in public block feeds, but the active status indicates the operator may be testing distribution channels.

Organizations should continue to block fxempire.es at network perimeter and DNS layers, monitor for any changes in its resolution or HTTP behavior, and incorporate the domain into existing threat‑intel feeds. Periodic re‑scans with VirusTotal or similar multi‑engine platforms are recommended to capture any future detections.