hezowin[.]com

On July 20, 2026, analysis of the newly registered domain hezowin.com was completed. The domain was created on July 15, 2026 and is currently active. Registration records show it was enrolled through Fewmoretaps OU d/b/a Trustname.com. Authoritative DNS is provided by ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com and ns4.nameserverhub.com, and the A record resolves to the IPv4 address 66.198.225.39. The host is listed on three public blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklist services. VirusTotal scans have returned eight positive detections out of ninety‑five scanners, indicating that multiple security engines consider the domain malicious. No additional public intelligence such as Safe Browsing or OTX entries were supplied, and the page title and any brand targeting have not been disclosed, leaving the exact phishing lure uncertain. Infrastructure analysis suggests the domain relies on a shared DNS provider and a single IP address, a pattern commonly observed in short‑lived phishing campaigns. Defenders should block DNS resolution for hezowin.com at the network perimeter, add the IP 66.198.225.39 to deny lists, and ensure endpoint protection solutions incorporate the eight VirusTotal detections. Continuous monitoring of the four nameservers is recommended, as changes may indicate migration to new hosting. Given the recent creation date and active status, the domain should be treated as high‑risk until takedown or further forensic evidence confirms cessation.