exho[.]pro

The domain exho.pro was registered on 24 January 2025 through the REGRU‑RU registrar. DNS resolution points to the IP address 104.21.80.1, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The web server returns HTTP 200 and presents the page title “EXHO | Open the world of luck and rewards!”. No TLS certificate is presented, meaning the site is served over plain HTTP. The domain is listed on a single security blocklist and has been flagged by the PhishDestroy service.

Analysis identifies this site as a brand‑impersonation campaign targeting the foundation brand, as indicated in the intelligence that the domain “impersonates: foundation”. The combination of a high‑risk classification, a Gridinsoft trust score of 0 / 100, and three out of ninety‑five VirusTotal scanners raising detections reinforces the malicious intent. The absence of an SSL certificate suggests that any credential or personal data entered by a victim would be transmitted unencrypted, a common trait of credential‑harvesting operations. Use of Cloudflare’s CDN masks the origin server, but the single resolved IP confirms a centralized hosting point.

Defenders should add exho.pro to network and email blocklists, enforce DNS sinkholing for the domain, and monitor outbound connections to 104.21.80.1. Organizations that employ the foundation brand should issue user awareness alerts highlighting that any unsolicited communication referencing “EXHO” or offering “luck and rewards” is not affiliated with the legitimate brand. Continuous scanning of the IP address and periodic re‑evaluation of VirusTotal and other reputation feeds are recommended to capture any changes in the threat landscape.