exobus[.]to

The domain exobus.to was registered on May 10, 2026 through a registrar identified as the Government of the Kingdom of Tonga. Its current status is listed as active, and it is classified as a generic phishing infrastructure. The domain is relatively new, and its age aligns with the rapid deployment patterns observed for high‑risk phishing campaigns. Infrastructure analysis shows that exobus.to resolves to the IPv4 address 144.31.231.231, which maps to a hosting facility in Switzerland (CH) operated by NekoClaw Ltd. The domain is served behind a CloudFlare, Inc. SSL certificate and responds with an HTTP 301 redirect before delivering a page whose title reads “Bytefend - 403 Forbidden”. The authoritative nameservers are ns0.1984.is, ns1.1984hosting.com, ns1.1984.is, and ns2.1984hosting.com, indicating use of the 1984 hosting infrastructure. Reputation data reinforce the malicious nature of the host. VirusTotal reports that 1 out of 95 security vendors have flagged the domain, while Gridinsoft assigns a trust score of 1 out of 100. The domain appears on three external blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in a single threat‑intel pulse, providing additional corroboration of its use in phishing operations. Given the convergence of a newly created domain, low trust scores, redirection to a forbidden page, and multiple independent blocklist entries, the evidence points to an active phishing campaign targeting unsuspecting users. Uncertainties remain around the specific payload or credential‑harvesting mechanisms employed, as the visible page does not expose malicious content directly. Defenders should block exobus.to at DNS and proxy layers, monitor for outbound connections to 144.31.231.231, and include the domain in threat‑intel feeds for broader correlation.