exoduscr[.]com

The domain exoduscr.com was registered on 21 February 2026. The site presented the page title “Exodus: the world's leading bitcoin and crypto wallet”, directly referencing the Exodus brand, which aligns with the reported brand‑target of Exodus. The SSL certificate presented as “WE1”, and the host resolves to 104.18.36.212, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Infrastructure fingerprinting shows the web server runs Nginx behind Google Cloud services, with Google Cloud CDN enabled. The site was flagged by 12 of 93 security vendors on VirusTotal and appears on a single external blocklist; it has also been listed by the PhishDestroy blocklist.

Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low confidence level. The classification supplied identifies the operation as a crypto‑scam, consistent with the brand impersonation observed in the page title. At the time of analysis the domain was reported as offline, which limits further behavioural observation. No additional details regarding the registrar, HTTP response codes, or content beyond the page title are available. Consequently, the full scope of the phishing infrastructure, such as any credential‑harvesting endpoints or secondary payload delivery mechanisms, remains uncertain.

Defenders should proactively block the domain name exoduscr.com and its resolving IP address 104.18.36.212 at network perimeters. The associated Cloudflare ASN (AS13335) can be monitored for anomalous traffic patterns targeting cryptocurrency users. Adding the domain to internal URL filtering lists and sharing the detection count (12/93) with threat‑intelligence platforms will improve collective awareness. Continuous re‑scanning of the domain is advised in case it re‑appears, and any future observations of the SSL certificate “WE1” should be correlated with this indicator set.