exwou[.]com

Analysis of exwou.com, observed as an active generic phishing site, indicates a high‑confidence malicious profile. The domain was registered on June 07, 2026 through Fewmoretaps OU operating as Trustname.com, and it is delegated to Cloudflare nameservers dalary.ns.cloudflare.com and tony.ns.cloudflare.com. Within a week of creation the domain appears on a public security blocklist and has been explicitly blocked by the PhishDestroy feed, demonstrating rapid abuse.

VirusTotal scans have recorded 11 detections out of 91 security vendors, confirming that multiple independent engines identify the host as malicious. No additional infrastructure details such as IP address, autonomous system number, or geographic location are available in the current intelligence set, and there is no publicly disclosed page title, SSL certificate information, or HTTP response code. Consequently, the precise landing page content and target brand remain undetermined, but the classification as generic phishing is supported by the vendor detections and blocklist presence.

Defenders should immediately add exwou.com to DNS and proxy deny lists, ensure endpoint web filters reference the PhishDestroy block, and monitor for any related sub‑domains or future registrations using the same registrar. Continuous observation of Cloudflare name‑server activity is advised, as any change may indicate a shift in hosting strategy. Given the recent creation date and the breadth of vendor alerts, the domain should be treated as high‑risk until further forensic evidence is gathered.