oxeo.net is currently flagged as a high‑risk generic phishing infrastructure. The domain resolves to the IPv4 address 144.172.108.243 and was registered on 24 April 2025 through Gname.com Pte. Ltd. Its authoritative name servers are a.share-dns.com, a12.share-dns.com, b.share-dns.net and b12.share-dns.net, a configuration commonly observed in fast‑flux or shared‑hosting phishing kits. VirusTotal has recorded 7 of 91 security vendors flagging the domain, indicating a modest but non‑trivial detection rate. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has taken remediation action.
No public evidence of SSL certificates, HTTP response codes, page titles, or Safe Browsing verdicts is presently available, leaving the exact content of the site unverified. The lack of additional contextual data means that attribution, payload type, and target brand remain unknown. Defenders should treat oxeo.net as hostile: ingest the domain and its resolving IP into DNS and proxy blocklists, enforce outbound filtering to prevent credential submission, and monitor network traffic for connections to 144.172.108.243.
Correlation with other domains using the same name‑server set may reveal a broader campaign. Continuous re‑scanning on VirusTotal and periodic checks of blocklist feeds are recommended to capture any changes in detection status. Given the high risk rating and active status, proactive containment is advised.