csodexpert[.]com

Analysis of csodexpert.com, observed on July 25, 2026, shows multiple indicators of malicious activity. The domain resolves to IP address 199.36.158.100, which is owned by Fastly, Inc. (AS54113) and is located in the United States. The hosting provider is Fastly, a common CDN used by threat actors to obscure origin infrastructure. The site serves HTTP status 200 and presents a valid SSL certificate issued by Google Trust Services under the WR3 certificate profile, indicating that TLS encryption is correctly configured but does not guarantee legitimacy. The page title returned by the server is "Expert Cornerstone OnDemand (CSOD) Implementation | Mark Adams," suggesting an attempt to reference the Cornerstone OnDemand brand, consistent with the recorded brand impersonation attribute.

The domain was registered on October 27, 2025 through DNC Holdings, Inc., and its authoritative name servers are ns0.directnic.com through ns3.directnic.com. A single MX record (priority 0) points to mail.csodexpert.com, an indication that email services may be operational for phishing campaigns. Technical fingerprints include the use of Firebase, Tailwind CSS, Unpkg, Google Analytics, Calendly, HTTP/3, and enforced HSTS, all of which are typical of modern web applications but also commonly leveraged by malicious operators to improve credibility and tracking capability. Reputation data shows a Gridinsoft trust score of 0 out of 100 and detection by two independent blocklists (PhishDestroy and ScamSniffer). VirusTotal scanning reports three of ninety‑five security vendors flagging the domain, reinforcing the suspicion of malicious intent.

The recorded scam type is "Crypto Scam," and the domain is listed as impersonating the broader brand category "across," implying a wide‑range targeting approach. While the available evidence strongly points to a high‑risk, active crypto‑related impersonation campaign, the precise payload or victim interaction flow has not been publicly disclosed.