risex-exchanges[.]com

risex-exchanges.com was registered on 21 July 2026 through UnstoppableUS2 LLC. The domain uses the Unstoppable Domains name servers ns1.unstoppabledomains.com and ns2.unstoppabledomains.com and resolves to the IPv4 address 186.2.175.103. Shortly after registration the domain was added to the PhishDestroy blocklist and currently appears on one additional security blocklist, indicating that at least one defensive feed has flagged it as malicious. VirusTotal has processed the domain with 91 antivirus and URL‑reputation engines; none of the engines returned a positive detection at the time of analysis. The absence of detections does not constitute a validation of safety, especially given the recent creation date and the presence on a phishing blocklist.

The available intelligence does not include HTTP response codes, SSL certificate details, page title, or any observed brand targeting, so the exact content served by the site remains unknown. The classification as “generic phishing” is derived from the blocklist labeling rather than from observed page content. Infrastructure analysis is limited to the single A record and the registrar information; no additional sub‑domains, CNAME records, or hosting provider details have been disclosed. The domain’s age of less than 48 hours and its rapid appearance on a phishing blocklist suggest a short‑lived campaign that may rely on mass‑registration techniques.

Defenders should continue to monitor the domain for changes in DNS resolution, newly observed IP addresses, or the appearance of TLS certificates. Adding the domain to local deny lists and ensuring that web‑gateway and endpoint protections reference the PhishDestroy feed will block known malicious traffic. Because the site is still active, any email or web traffic that resolves to 186.2.175.103 should be treated as suspicious and subjected to additional verification steps before credential submission.