exmo1[.]be

Analysis of exmo1.be, created on February 21, 2026, shows that the domain resolves to the IPv4 address 188.208.37.102, which is hosted in Belgium under ASN 34762 owned by Combell NV. The registrar information confirms that the domain was registered through Combell nv and is served by the name servers ns3.combell.net, ns4.combell.net, and ns1.combell.eu. The site is currently taken offline, but historical data indicate it was actively blocked by the PhishDestroy feed and appears on at least one public security blocklist. VirusTotal scans recorded three positive detections out of ninety‑three submitted security vendors, reinforcing the suspicion of malicious use.

A Gridinsoft trust score of 0 out of 100 further corroborates the low reputation of the host. The HTTPS certificate presented is a Let's Encrypt R12 certificate, which does not mitigate the underlying risk. Web‑technology fingerprinting identified a WordPress stack backed by MySQL and PHP, along with client‑side libraries such as particles.js, jQuery, jQuery Migrate, and a reference to YouTube, all served through an Nginx front end. These components are commonly leveraged in credential‑harvesting pages.

No page title or additional evidence links were captured, leaving the exact content of the site unverified. Defenders should treat exmo1.be as a malicious phishing infrastructure: block the domain and its associated IP at network perimeters, maintain the blocklist entry, and ensure email and web filtering solutions reference the current threat intelligence. Continuous monitoring of the IP address for re‑activation and periodic re‑scanning with VirusTotal or similar services are advised to capture any future changes in the host's behavior.