rexochange[.]com

Analysis of the domain rexochange.com indicates it was registered on February 21, 2026, and is currently offline, returning an HTTP 521 error with the page title 'rexochange.com | 521: Web server is down.' The domain resolves to IP address 172.67.162.207, hosted on Cloudflare infrastructure (AS13335) in the United States. No specific brand impersonation or scam category is confirmed in the available data, classifying this as a generic phishing domain under investigation. As of July 25, 2026, the domain appears on one security blocklist, and the service PhishDestroy has flagged it. No detections were reported by the 93 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety.

The SSL certificate is classified as WE1, a low-trust indicator often associated with newly registered or suspicious domains. The domain's recent creation and immediate use of Cloudflare suggest an attempt to obscure hosting details, a common tactic in phishing operations. Defenders should treat this domain as potentially malicious until further analysis confirms its legitimacy.

Network-level blocking is recommended for organizations using PhishDestroy or the identified blocklist. Monitoring for renewed activity, particularly if the domain resumes resolving to an active server, is advised. No evidence of credential harvesting, payment fraud, or other specific attack vectors is currently available, so additional context—such as user reports or phishing kit artifacts—would be required to classify the threat further.