wexnes[.]com

Analysis of wexnes.com shows a newly registered domain created on July 03, 2026 that is currently listed as active. The domain is delegated to Cloudflare name servers (chelsea.ns.cloudflare.com and frank.ns.cloudflare.com) and resolves to the IP address 172.67.147.12, a Cloudflare‑hosted address commonly used for fast‑flux or proxy services. Registration was performed through Dominet (HK) Limited, a registrar based in Hong Kong, which does not provide additional protective metrics.

The domain has been added to at least one external security blocklist and is also flagged by the PhishDestroy service, indicating that known threat‑intelligence feeds have identified it as malicious. VirusTotal reports that the domain has been scanned by 91 antivirus or URL‑reputation engines, none of which have generated a detection at the time of analysis; however, the absence of detections is not evidence of benign behavior and should not be interpreted as a safety guarantee. The available data do not include a page title, explicit brand impersonation, or any observed payload, so the precise phishing lure remains undefined.

Defenders should treat wexnes.com as a high‑confidence malicious indicator: add the domain to network and web filtering rules, enforce DNS‑level blocking, and monitor for any outbound connections to the associated IP address. Continuous re‑scanning of the domain with reputation services is recommended to capture any future changes in detection status. Organizations should also consider reviewing recent email logs for messages containing links to wexnes.com, as such traffic may be part of a broader credential‑harvesting campaign.