exxolix[.]com

The domain exxolix.com is currently active and is being used in a social media phishing campaign that pretends to offer a cryptocurrency exchange service. The site’s page title explicitly advertises a "Crypto Exchange Platform: Online Cryptocurrency Coin Exchange By Exolix," indicating an attempt to masquerade as a legitimate crypto‑exchange brand. The domain was registered on 23 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare (AS13335), resolving to the IP address 188.114.97.3 located in the United States. Technical fingerprints show a Node.js/Express stack with Cloudflare Browser Insights and HTTP/3 support, and the site serves a Let’s Encrypt SSL certificate (E8).

An HTTP 200 response is returned for the root request, confirming that the web service is reachable. Reputation data is poor: a Gridinsoft trust score of 0 / 100, inclusion on a single security blocklist (PhishDestroy), and detection by two out of ninety‑three VirusTotal scanners. The domain also appears on at least one additional blocklist, reinforcing its malicious status. Nameservers are newt.ns.cloudflare.com and pearl.ns.cloudflare.com, consistent with the Cloudflare front‑end.

Defenders should immediately block exxolix.com at the DNS or firewall level, add the IP 188.114.97.3 to network‑wide deny lists, and monitor outbound connections for attempts to resolve or contact the domain. Because the page content has not been publicly analyzed, further investigation of the site’s payload (e.g., credential‑stealing forms) is advised. Continuous telemetry from security appliances should be used to detect any residual traffic, and any related indicators of compromise should be shared with threat‑intel feeds to improve community defenses.