wirexen[.]com

wirexen.com is currently offline but remains flagged as a brand impersonation site. The domain was registered on February 21 2026 through NameCheap, Inc. and resolves to the IPv4 address 162.246.16.93, which is hosted by Interserver, Inc. in the United States (AS19318). No TLS certificate is presented, indicating that the site only serves HTTP content. The page title returned from the host is the literal string "wirexen".

VirusTotal records show that six of ninety-five security vendors have classified the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on three public security blocklists and has been cited in a single AlienVault OTX pulse. Additional defensive products, including PhishDestroy, MetaMask, and SEAL, have already blocked the domain. Nameserver entries point to da500a.trouble-free.net and da500b.trouble-free.net, which are commonly observed in malicious infrastructure.

While the exact brands being impersonated are not disclosed beyond the generic "across" label, the classification as brand impersonation suggests the site was designed to lure victims by mimicking legitimate brand assets. Because the site is offline, active payload delivery cannot be confirmed, but the combination of low trust score, multiple vendor detections, and blocklist listings indicates a high likelihood of malicious intent. Defenders should add 162.246.16.93 to network-level deny lists, ensure the domain is blocked in DNS filtering solutions, and monitor for any future domain registrations that use similar naming patterns or the same authoritative nameservers. Continuous ingestion of the associated OTX pulse and blocklist feeds will aid in early detection of re-hosted or derivative campaigns.