vexskins[.]com

Analysis of vexskins.com indicates an active phishing infrastructure registered on July 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP address 104.21.49.131 and uses Cloudflare nameservers (cash.ns.cloudflare.com and susan.ns.cloudflare.com), a common configuration observed in phishing campaigns to obscure hosting origins. As of July 28, 2026, the domain appears on one security blocklist, specifically PhishDestroy, which suggests prior detection of malicious activity, though the exact nature of the phishing content remains unconfirmed. VirusTotal scans by 91 vendors report no detections at this time, though this absence does not confirm safety and may reflect delayed or incomplete coverage by detection engines.

Defenders should note that the domain's recent registration (four days old at the time of reporting) aligns with patterns of short-lived phishing sites designed to evade long-term scrutiny. The use of Cloudflare nameservers further complicates attribution, as the hosting provider's proxy services mask the true origin of the infrastructure. No brand impersonation or specific scam type has been identified in the available data, classifying this as a generic phishing domain until further analysis is conducted. The lack of additional blocklist inclusions or public threat intelligence references limits contextual understanding, though the single blocklist entry warrants caution.

Recommended actions include monitoring the domain for changes in detection status, particularly on platforms like VirusTotal or URLScan, and cross-referencing with internal logs for connections to 104.21.49.131 or related Cloudflare IPs. Network-level blocking may be considered based on the PhishDestroy flag, though false positives should be ruled out if the domain is associated with legitimate traffic. Further investigation into SSL certificates, HTTP response headers, or historical DNS records may provide additional indicators of compromise.