exdex[.]xyz

Analysis of exdex.xyz, created on October 03, 2024 through the Namecheap Inc registrar, shows the domain is actively serving a generic phishing campaign. The domain resolves to the IPv4 address 91.108.190.154 and is hosted on Cloudflare infrastructure, as indicated by the authoritative name servers celine.ns.cloudflare.com and moura.ns.cloudflare.com. Threat intelligence sources have already taken defensive action: the site is listed on a single security blocklist and has been specifically blocked by the PhishDestroy service.

On VirusTotal the domain was examined by 91 security vendors, of which three returned a positive detection, reinforcing the malicious classification. Current status remains active, confirming that the phishing infrastructure continues to be operational. The limited publicly available data means that page‑level attributes such as HTTP response codes, SSL certificate details, page title, or any referenced brand targets have not been disclosed, leaving those aspects of the attack surface unverified.

Defenders should prioritize immediate blocking of exdex.xyz at the DNS and proxy layers, as well as the associated IP address 91.108.190.154, to prevent end‑user exposure. Continuous monitoring of the Cloudflare name servers for any changes, and periodic re‑scanning with VirusTotal or equivalent multi‑engine services, are recommended to capture any evolution in the domain’s detection profile. Organizations employing web filtering should also ensure the domain is added to internal blocklists and that any outbound traffic to the identified IP is logged and investigated for potential compromise.