exovum[.]sale

This domain, exovum.sale, is assessed as an elevated-risk credential theft site designed to harvest user login credentials through deceptive login portals. Analysis indicates the infrastructure is tailored to mimic legitimate authentication flows, likely targeting unsuspecting users who input sensitive information into fraudulent forms. The threat type is specific to credential theft, not generic phishing, as evidenced by the domain's structure and detected technologies. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.203.8 and is flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100. Detected technologies include WordPress, MySQL, PHP, particles.js, Chart.js, Slick, jQuery Migrate, and jQuery, suggesting a sophisticated frontend designed to appear legitimate while concealing malicious backend functionality. Mitigation steps for this credential theft threat include immediate blocking of the domain and its associated IP (172.67.203.8) at the network perimeter. Organizations should deploy endpoint protection rules to prevent access to the domain and monitor for any attempts to reach it. Users who may have interacted with the site should be instructed to reset credentials for any accounts entered on the domain, particularly if reused across platforms. Security teams should review logs for connections to 172.67.203.8 or DNS queries for exovum.sale to identify potential compromised endpoints. Given the domain's offline status, proactive monitoring for related infrastructure (e.g., newly registered domains under the same registrar) is recommended to preempt future threats.