zexawin[.]com

This domain is flagged for elevated-risk credential harvesting phishing activity targeting users through fraudulent login portals. Analysis indicates zexawin.com is designed to mimic legitimate authentication interfaces, capturing sensitive credentials such as usernames, passwords, and multi-factor authentication codes. The threat type is classified as generic_phishing with a focus on direct user deception, likely distributed via email or social engineering vectors. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk registrations. The domain resolves to IP address 104.21.11.211, hosted by Cloudflare, Inc. in Canada, a common proxy service used to obscure malicious infrastructure. VirusTotal reports 10 out of 95 security vendors flagging this domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Let's Encrypt (serial number E7), provides encrypted connections but does not validate legitimacy, as phishing sites routinely use valid certificates to appear trustworthy. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (104.21.11.211) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) such as the domain name, IP address, and SSL certificate serial number (E7) into endpoint detection and response (EDR) systems and email security gateways. User awareness training should emphasize identifying fraudulent login prompts, particularly those mimicking corporate or financial services. Monitoring for related domains registered through Fewmoretaps OU or resolving to Cloudflare IPs may uncover additional phishing infrastructure. Network logs should be reviewed for connections to 104.21.11.211 or DNS queries for zexawin.com to identify compromised endpoints.