exonsoai[.]com

Analysis indicates that exonsoai.com was registered on September 30, 2025 through Porkbun LLC and is presently taken offline. The domain resolves to 172.67.186.62, an address owned by Cloudflare (AS13335) located in the United States, and is served via Cloudflare nameservers jihoon.ns.cloudflare.com and rafe.ns.cloudflare.com. The site employed Cloudflare’s edge services, including HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WE1 profile, confirming that encrypted transport was in place when the site was active.

The only observable content is the page title "Xelthmexon Dhramexil - Advanced Gourmet Cooking Mastery," which bears no obvious relation to any legitimate brand, yet the intelligence tag classifies the campaign as a brand impersonation targeting "across" – suggesting the operators intended to lure victims by pretending to represent that brand. VirusTotal scans recorded detections from two of ninety‑five security vendors, reflecting a modest but non‑trivial level of malicious classification. The domain has been added to at least one public blocklist and is actively blocked by the PhishDestroy filtering service.

While the site is no longer reachable, the underlying infrastructure – a Cloudflare‑fronted IP address – remains reusable for future campaigns. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for re‑registration of the same name or similar patterns, and consider adding the associated IP address to deny lists. Ongoing vigilance is advised because the Cloudflare front end can be repointed to new origins without altering the domain name or IP, allowing the threat actor to reactivate the campaign quickly if the domain is re‑registered.