tomexbit[.]com

Analysis of the domain tomexbit.com, created on 21 February 2026, indicates that it is currently offline but was previously associated with a generic phishing campaign. The authoritative name resolution returned the IPv6 address 2606:4700:3034::6815:3e1d, which is allocated to Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented for the domain is identified as WE1, confirming the use of HTTPS. The page title retrieved during the brief observation period was “Home | Febeast”, suggesting that the site may have attempted to impersonate or reference the Febeast brand, although no further content analysis is available. The domain was submitted to VirusTotal, where 93 scanning engines evaluated the site and none reported a detection at the time of the scan.

While the lack of detections does not guarantee the absence of malicious payloads, it indicates that the majority of automated scanners did not flag the host as malicious during that snapshot. Additional reputation data shows that the domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the classification as a phishing‑related resource. Given the available evidence, the primary indicators of compromise are the recent registration date, the association with a Cloudflare‑hosted IPv6 address, the presence of a TLS certificate, and the page title referencing “Home | Febeast”. No information is present regarding the registrar, the underlying phishing kit, or any victim reports.

Consequently, uncertainty remains about the specific tactics employed, the targeted audience, and whether the domain ever served functional phishing pages before being taken offline.