exvolv[.]org

exvolv.org was registered on July 18, 2025 through Web Commerce Communications Limited. The domain is served behind Cloudflare’s network (AS13335) and resolves to the IPv6 address 2606:4700:3032::6815:4fdd located in the United States. TLS termination is provided by Google Trust Services under the WE1 certificate, indicating a valid certificate chain. The authoritative nameservers are ariadne.ns.cloudflare.com and bryce.ns.cloudflare.com, both operated by Cloudflare.

At the time of analysis, VirusTotal records show that 15 out of 95 security vendors have flagged the domain, reflecting a moderate level of suspicion. Google Safe Browsing classifies the site under the SOCIAL_ENGINEERING category, and it appears on one external blocklist. Independent reputation services assign extremely low trust scores: Gridinsoft reports 0/100, Scamadviser 1/100, and PhishDestroy has already blocked the domain. AlienVault OTX references the domain in a single threat‑intelligence pulse.

The public page title reads “Exvolv Your Ultimate Cryptocurrency Trading and Investment Platform”, and the site is identified as an investment‑type scam. Front‑end inspection reveals the use of Vue.js, jQuery, Cloudflare services, and HTTP/3, with an HTTP 200 response code. No additional malicious payloads or redirection behavior have been observed from the available metadata, and the content beyond the title has not been publicly disclosed.

Because the site’s visual content and credential‑collection mechanisms have not been captured, the precise method of victim exploitation remains unknown. Defenders should continue to block exvolv.org at network perimeter and DNS layers, monitor for any new IP resolutions or certificate changes, and incorporate the domain into threat‑intel feeds. Continuous re‑evaluation is advised in case the infrastructure evolves or additional detection signals emerge.