extyhub[.]org

The domain extyhub.org has been identified as a phishing site specifically targeting users of the Exty brokerage platform. Analysis indicates this is a generic_phishing threat, designed to impersonate legitimate financial services under the guise of 'Extyhub - Exty Brokerage.' As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively harvesting credentials or financial information from unsuspecting victims. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on June 09, 2025, and resolved to the IP address 199.188.205.20. Despite its recent creation, the domain appears on one security blocklist and has been flagged by PhishDestroy. Trust scores from Scamadviser and Gridinsoft both indicate extreme risk, with ratings of 1/100 and 0/100, respectively. VirusTotal reports 0 detections out of 95 vendors, suggesting the campaign may have evaded initial automated detection. The site employed a Let's Encrypt SSL certificate and utilized technologies such as PHP, Bootstrap, and LiteSpeed, which are commonly observed in phishing infrastructure. The domain is currently offline, though the rapid deployment and targeting of a specific financial brand warrant continued monitoring. Organizations and users are advised to block the domain and associated IP address 199.188.205.20 at the network level. Security teams should review logs for connections to this IP or domain, particularly from systems that may have accessed financial services. Given the low detection rates, manual verification of similar domains registered through NameCheap in June 2025 is recommended to identify potential related threats.