auth-exodus[.]app

This domain, auth-exodus.app, is actively flagged as a high-risk brand impersonation site targeting Exodus, a known cryptocurrency wallet provider. Analysis indicates the domain was registered on March 4, 2026, through TLD Registrar Solutions Ltd and currently resolves to the IP address 91.92.242.6. The infrastructure reveals the use of a Let's Encrypt SSL certificate, Google Web Server technology, HSTS, and HTTP/3, which are not inherently malicious but are commonly leveraged in phishing operations to appear legitimate. The page title, 'Google,' is atypical for a service claiming to represent Exodus and raises further suspicion about the site's intent. The domain appears on five security blocklists, including PhishingArmy, PhishDestroy, OISD, CERT-PL, and BLP-Malware, and is flagged by 16 out of 95 security vendors on VirusTotal. Additionally, it has been included in 25 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition of its malicious nature. The Gridinsoft trust score of 0/100 reinforces the assessment that this domain is not safe for users. While the exact content of the site has not been analyzed, the combination of brand impersonation, recent registration, and multiple security flags strongly indicates an active phishing campaign. Defenders should treat this domain as hostile and take immediate action to block access. Network-level protections, such as DNS filtering or IP-based blocking of 91.92.242.6, can mitigate exposure. Organizations should also monitor for any internal traffic to this domain and investigate potential compromises if connections are detected. Users who may have interacted with the site should be advised to change credentials, enable multi-factor authentication, and review their accounts for unauthorized activity. Given the domain's persistence as of July 12, 2026, continued vigilance is necessary.