Analysis of home.fexowin.com indicates a recently established credential-phishing domain registered on July 23, 2026, through Fewmoretaps OU operating as Trustname.com. The domain remains active as of July 28, 2026, and resolves to IP address 64.7.198.11. Infrastructure review shows Cloudflare nameservers (chase.ns.cloudflare.com and pola.ns.cloudflare.com), a common configuration for phishing sites seeking anonymity and DDoS protection.
The domain appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal detection data reports 14 of 91 security vendors flagging the domain, suggesting moderate but not universal recognition of its malicious nature. No specific brand impersonation, phishing kit, or page content details are available in current intelligence.
Defenders should treat this domain as high-risk for credential theft and implement blocking at DNS, proxy, or endpoint levels. Further investigation into associated IP infrastructure and SSL certificates may reveal additional linked domains or campaigns. Given the domain's recent registration and active status, monitoring for new detections or shifts in hosting is recommended.