Analysis of desuwex.com indicates an active generic phishing infrastructure that was registered on May 02, 2026. The domain is hosted on the IP address 188.114.96.3 and uses Cloudflare name servers donovan.ns.cloudflare.com and ines.ns.cloudflare.com. Registration details list Fewmoretaps OU d/b/a Trustname.com as the registrar, suggesting a low‑cost bulk registration service.
The site has been blocked by three independent security products—PhishDestroy, MetaMask, and SEAL—and appears on three external security blocklists, reinforcing the view that the domain is being leveraged for malicious credential harvesting. VirusTotal scans show 14 of 91 security vendors flag the domain, providing additional technical corroboration of its malicious nature. The risk level is assessed as high, and the current operational status remains active, meaning the phishing campaign is still live.
Defenders should proactively block desuwex.com at the DNS and proxy layers, blacklist the associated IP address 188.114.96.3, and add the domain to internal threat intelligence feeds. Continuous monitoring of the Cloudflare name servers for any changes is recommended, as well as periodic re‑scans with VirusTotal and other sandbox services to capture any evolution in payload or hosting behavior.