hotexc[.]com

Analysis of hotexc.com indicates that the domain is actively being used for generic phishing campaigns. The domain was registered on September 04, 2025 through Spaceship, Inc., and currently resolves to the IP address 172.67.161.31. It appears on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal reports that four out of ninety‑one scanned security vendors have flagged the domain as malicious, reinforcing the blocklist observations.

The elevated risk rating reflects the convergence of multiple independent detections despite the limited public fingerprint of the site. The hosting infrastructure is shared with other Cloudflare‑served sites, which limits attribution of additional malicious activity to the same operator. No public SSL certificate details, HTTP response codes, or page title information have been disclosed, and the content of the landing page has not been captured in the available intelligence. Consequently, the precise phishing lure, target brand, or credential‑harvesting mechanism remains unknown.

Defenders should add hotexc.com to deny‑list rules across DNS resolvers, proxy gateways, and endpoint protection platforms. Network monitoring should include alerts for outbound connections to 172.67.161.31, and any credential submissions to the domain should be treated as compromised. Continuous re‑evaluation is advised as additional telemetry, such as page snapshots or sandbox analysis, becomes available.