xeowax[.]com

PhishDestroy identifies xeowax.com as an active credential harvesting domain posing immediate risks to unsuspecting users. This domain is engineered to deceive victims into surrendering sensitive login credentials through fraudulent web forms or spoofed login portals, aligning with tactics observed in modern phishing operations. The low detection rate combined with recent infrastructure deployment signals heightened urgency for proactive blocking and user awareness.

This domain was flagged with zero detections out of 95 tested engines on VirusTotal, indicating minimal exposure despite its active deployment. Registered through Gname.com Pte. Ltd. on March 11, 2026, xeowax.com resolves to IP address 172.67.134.74, a server associated with dynamic or temporary hosting infrastructure. The domain holds a valid Let’s Encrypt SSL certificate, which may enhance its credibility in the eyes of potential victims by displaying the padlock icon in browsers.

To mitigate the threat, organizations and users should immediately block xeowax.com and its resolving IP at the network and endpoint levels. Avoid accessing the domain or clicking any embedded links, as they may deliver malware or capture submitted credentials. Report this domain to your security team and consider leveraging threat intelligence platforms to enrich detection rules. If credentials were entered, reset passwords immediately and enable multi-factor authentication across affected accounts.