exodusix[.]com

The domain www.exodusix.com was registered on February 21, 2026 through Dominet (HK) Limited and resolves to the Amazon-owned IP address 184.72.1.207, which is listed under ASN AS16509 (Amazon.com, Inc.) and geolocated to the United States. The authoritative name servers are ns7.alidns.com and ns8.alidns.com. No TLS certificate is presented for the site, indicating that HTTPS was not provisioned. The page title returned by the server is "Exodus," matching the declared brand target "Exodus" and aligning with the classified scam type of a crypto‑related impersonation.

The domain is currently offline, and the risk level is marked elevated. Defensive intelligence flags include a Gridinsoft trust score of 0 out of 100, placement on one security blocklist, and a block by the PhishDestroy service. VirusTotal analysis reports that two of ninety‑five scanned security vendors flagged the domain, providing additional corroboration of malicious intent. The available evidence does not reveal the specific payload or phishing kit employed, nor does it disclose any observed HTTP response codes beyond the offline status.

Uncertainty remains regarding the exact tactics used to lure victims, such as whether credential harvesting or cryptocurrency address substitution was employed. Defenders should continue to monitor the IP address 184.72.1.207 for related activity, enforce blocklisting of the domain across web gateways, and incorporate the registrar and name‑server information into threat‑intel feeds to pre‑empt future registrations of similar infrastructure. Additionally, organizations that reference the Exodus brand should advise users to verify the presence of a valid TLS certificate and to rely on official Exodus URLs, as the lack of encryption and the brand‑matching page title are indicative of a deceptive deployment.