true[.]exodususer[.]sbs

On July 23, 2026, the domain true.exodususer.sbs was examined following reports of brand impersonation targeting Exodus users. The site resolves to the IPv4 address 82.25.120.238, which is hosted in India under AS47583 owned by Hostinger International Limited. Registration data shows the domain was created on April 30, 2025 through NameCheap, Inc., and it is serviced by the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. The HTTPS certificate presented a rating of R12, indicating a low‑trust certificate typically associated with abusive infrastructure. The page title returned by the server reads "True Capital Traders | Your Trusted Bitcoin Mining and Investment Company," explicitly marketing a cryptocurrency mining and investment proposition and confirming the classification as a crypto scam.

The content claims to be a trusted service, yet the domain is listed as impersonating the Exodus brand, suggesting an attempt to lure Exodus wallet users into fraudulent transactions. VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of malicious intent. The domain appears on a single public blocklist and is actively blocked by PhishDestroy, a known anti‑phishing service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely high risk profile.

The current HTTP status indicates the site is offline, but the historical evidence demonstrates a clear pattern of malicious activity. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicators, and monitor for any re‑hosting attempts using the same IP range or similar name‑server configurations. Threat hunters should also correlate any outbound connections to 82.25.120.238 with user activity involving Exodus wallet credentials, as compromised accounts may have been targeted during the site’s active period.