exolixx[.]com

This domain is flagged as an elevated-risk generic phishing threat targeting cryptocurrency users. Analysis indicates it impersonates a legitimate crypto exchange platform, likely designed to harvest credentials or facilitate unauthorized transactions. The threat type aligns with known patterns of crypto drainers or fake login portals, where victims are tricked into entering sensitive wallet information or authorizing malicious transfers. Infrastructure analysis reveals the domain exolixx.com was registered through NiceNIC International Group Co., Limited on February 21, 2026, an atypical creation date that may indicate an attempt to evade detection. It resolves to the IP address 104.21.57.243 and uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. VirusTotal reports 6 out of 95 security vendors flagging the domain, and it appears on one security blocklist, specifically PhishDestroy. The page title, 'Crypto Exchange Platform: Online Cryptocurrency Coin Exchange By Exolix,' further supports the impersonation of a legitimate exchange service. Mitigation steps for this threat type include immediate cessation of interaction with the domain and any associated links. Users who may have engaged with the site should revoke any wallet authorizations granted during the session and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include the domain and IP address 104.21.57.243, while security teams are advised to investigate related infrastructure for additional indicators of compromise. Given the domain's current offline status, continuous monitoring for re-emergence is recommended, as phishing campaigns often recycle infrastructure.