welcome-exodose-en-us[.]square[.]site

The domain welcome-exodose-en-us.square.site is currently active and hosts a site that claims to be associated with the Exodus brand, a known crypto‑wallet provider. Registration data shows the domain was created on February 21, 2026 and was registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may be an attempt to lend credibility. DNS resolution points to the IP address 74.115.51.4, which is owned by AS27647 Weebly, Inc., a hosting provider that supplies the Weebly website‑building platform. The server presents a valid TLS certificate issued by Let’s Encrypt (E7), and an HTTP 200 response is returned, indicating the site is reachable and serving content.

The page title returned by the server is “Just a moment…”, a generic placeholder often used while further content loads or redirects, but no additional page analysis is available. Infrastructure fingerprints reveal the presence of Weebly, MySQL, PHP, Vue.js, Amazon Web Services, reCAPTCHA, and Cloudflare, suggesting a layered hosting stack that includes both the Weebly builder and Cloudflare’s CDN and security services. Security assessments show a Gridinsoft trust score of 0 / 100, and two out of ninety‑three VirusTotal scanners flagged the domain, indicating some detection of malicious behavior. The domain appears on a single public blocklist and has been added to PhishDestroy’s blocklist, confirming that at least one security‑vendor community has identified it as abusive.

The primary threat classification is a crypto‑scam, consistent with the brand impersonation of Exodus. While the site’s exact content and user‑interaction flow have not been publicly disclosed, the combination of a newly registered domain, low trust scores, partial vendor detections, and the presence of reCAPTCHA and Cloudflare suggests an attempt to evade automated analysis while still delivering a malicious payload or phishing page.