ex-finance-brazil[.]com

Analysis of ex-finance-brazil.com shows a newly registered domain (created 23 Feb 2026) hosted behind Cloudflare’s network (IP 172.67.163.250, AS13335, United States). The domain is served over HTTPS using a Google Trust Services certificate issued by the WE1 intermediate, indicating a valid TLS chain. HTTP requests return status 200 and the page title reads “Exness Brasil: Plataforma de Trading Confiável”, suggesting an attempt to impersonate the Exness trading platform. Underlying technology fingerprints identify WordPress with MySQL, PHP, Yoast SEO, jQuery and Cloudflare HTTP/3, a common stack for content‑driven sites.

Reputation checks reveal a Gridinsoft trust score of 0 / 100 and two detections out of 93 scanners on VirusTotal, confirming malicious classification by a minority of anti‑malware engines. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, reinforcing the phishing risk assessment. Registration was performed through NiceNIC International Group Co., Limited, and the authoritative nameservers are lucy.ns.cloudflare.com and yahir.ns.cloudflare.com, both owned by Cloudflare. The evidence points to a high‑risk, active phishing campaign targeting users of the Exness brand, likely to harvest credentials or financial information.

Uncertainty remains around the specific payload or credential‑capture mechanism because the site’s internal content has not been analyzed. Defenders should add the domain and its resolving IP to outbound and inbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and ensure that corporate web‑filter solutions incorporate the listed blocklist and PhishDestroy feed. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any changes in detection rates. Organizations should also educate users about the false “Plataforma de Trading Confiável” claim and encourage verification of legitimate Exness URLs.