exo-check[.]com

The domain exo-check.com is currently listed as offline, returning an HTTP 410 status code, yet multiple security sources continue to flag it as malicious. Registration records show the domain was created on 13 July 2025 through Hosting Concepts B.V. d/b/a Registrar.eu, and it is delegated to the nameservers ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, and craig.ns.cloudflare.com. The authoritative IP address resolves to 15.197.130.221, an Amazon Web Services host (AS16509) located in the United States. No TLS certificate is present, meaning the site is reachable only via plain HTTP, a common characteristic of credential-harvesting infrastructure.

Reputation data indicate the domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows eight of ninety‑five scanned vendors classified the domain as malicious, reinforcing the likelihood of phishing use. Scamadviser assigns a trust score of 1 out of 100, reflecting extremely low confidence in the site’s legitimacy. The page title reported by the crawler is simply "exo-check.com", providing no additional context about the intended target or payload.

While the site is no longer serving content, the persistent indicators suggest an active phishing campaign that may have been taken down or moved to a new host. Defenders should continue to deny traffic to the domain and its associated IP address, incorporate the observed nameserver pattern into detection rules, and monitor for any resurgence of the same infrastructure under different hostnames. Because the underlying AWS infrastructure can be rapidly reprovisioned, threat-intel teams should also watch for new domains registered by the same registrar that resolve to the same ASN. In the absence of further evidence, the current data support maintaining an elevated risk posture for exo-check.com and related assets.