exosites[.]st

The domain exosites.st was first observed on March 06, 2026 and is currently classified as a generic_phishing site with a high risk rating. It returns an HTTP 301 redirect and is served over a valid Let's Encrypt certificate (issuer E8). VirusTotal records show that 3 of 95 scanned security vendors have flagged the domain, indicating that automated detection is limited but present. Registration data lists ST Registry as the registrar, and the domain is hosted on nameservers ns1.eggywall.cc and ns2.eggywall.cc. DNS resolution points to IP address 151.247.193.142, which is mapped to France but owned by AS399486 (12651980 CANADA INC.). The low Gridinsoft trust score of 1 out of 100 further suggests a malicious reputation. The infrastructure footprint is modest, with the domain appearing on only one public security blocklist and being blocked by the PhishDestroy feed. The combination of a fresh registration, a low‑reputation IP, and a generic SSL certificate aligns with typical phishing campaign deployment patterns. The high risk designation reflects the potential for credential harvesting or malicious redirection, despite the limited number of vendor detections. Defenders should immediately add exosites.st and its resolving IP 151.247.193.142 to deny lists and ensure that web filtering solutions block any HTTP 301 responses from this host. Continuous monitoring of the associated nameservers and the AS399486 range is advised, as the operators may pivot to additional domains. Updating intrusion detection signatures to flag the domain’s TLS fingerprint and low trust score will reduce exposure while investigations continue.