exxchanger[.]com[.]ua

Analysis as of 26 July 2026 indicates that the domain exxchanger.com.ua is operating as an active generic phishing infrastructure. The domain was registered on 21 April 2026 through the Ukrainian individual registrar ФОП Скуріхін Микола Володимирович and is served by the authoritative name servers dns1.hostiq.ua and dns2.hostiq.ua. DNS resolution points to the single IPv4 address 31.131.26.121, which is the sole host observed for this campaign.

The domain has been observed on one security blocklist and is currently blocked by the PhishDestroy filtering service. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors, none of which reported a detection at the time of analysis; this lack of detections does not constitute evidence of benign behavior. No additional intelligence such as SSL certificate details, HTTP response codes, or page title information is publicly available, leaving the exact content and target brand of the phishing page undefined.

The limited visibility of the infrastructure, combined with its recent creation date, suggests a short‑lived operational window typical of opportunistic phishing campaigns. Defenders should consider adding the domain and its resolving IP address to outbound and inbound filtering rules, monitor for any future detections across additional telemetry sources, and continue to track changes to the blocklist status. Ongoing observation is recommended to determine whether the campaign expands to additional domains or infrastructure components.