xoawex[.]com

PhishDestroy identifies xoawex.com as an active generic phishing domain linked to a crypto drainer campaign. The domain was created on March 11, 2026, and is currently under investigation due to its association with unauthorized cryptocurrency transaction theft. No specific brand impersonation has been confirmed at this stage, but the threat type points to a fake login portal designed to harvest credentials and drain crypto wallets.

This domain resolves to IP 172.67.167.116 and is registered through Gname.com Pte. Ltd. VirusTotal currently shows zero detections out of 95 scanners, indicating it remains undetected by most security solutions. The domain uses a Let's Encrypt SSL certificate to appear legitimate. At the time of analysis, xoawex.com is not flagged in Google Safe Browsing (GSB) and has not been widely blocklisted, leaving users vulnerable to exposure.

The domain status is active and under investigation. Users are advised to avoid interacting with xoawex.com and verify unknown domains using PhishDestroy’s real-time threat lookup. While the immediate risk is high due to active deployment, the lack of detections suggests it may expand before widespread blocking occurs. PhishDestroy continues to monitor and update its threat intelligence feed with this seed identifier 6215b0.