exxon[.]nano-dev[.]shop

Analysis of exxon.nano-dev.shop confirms its classification as a credential phishing domain targeting users through a login-themed page. The domain, created on February 21, 2026, resolved to IP 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. As of July 24, 2026, the site is offline, though it remains listed on one security blocklist. Detection vendors flagged the domain, with PhishDestroy blocking it outright and Gridinsoft assigning a trust score of 0/100.

VirusTotal records indicate 3 of 95 security vendors marked the domain as malicious, though the specific detection context is not detailed in available intelligence. The SSL certificate (R13) and page title ('Login') align with typical phishing infrastructure, though no brand-specific targeting beyond the domain name itself is confirmed in the provided data. The scam type is explicitly labeled as credential phishing, suggesting the site was designed to harvest user credentials.

Defenders should treat this domain as a confirmed threat, particularly for organizations or users associated with the implied brand. While the site is currently offline, historical resolution to the HostPapa IP and its presence on a blocklist warrant continued monitoring. No evidence links this domain to broader phishing kits or campaigns, and further forensic analysis of the hosting infrastructure may be required to assess potential connections to other malicious activity.