# PhishDestroy domain threat record: en-exodus-wallet.co.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/en-exodus-wallet.co.com/ Machine-readable companion: https://phishdestroy.io/domain/en-exodus-wallet.co.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-23 16:40:08 UTC - Last availability or vendor check: 2026-10-21 22:32:49 UTC - Stored record updated: 2026-10-22 14:22:05 UTC - VirusTotal detections in the stored snapshot: 13/90 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Exodus ## Stored infrastructure - Observed IP address: 45.74.7.27 - Registrar in stored WHOIS data: Moniker Online Services LLC - Registration date (registry RDAP, co.com): 1997-08-16 04:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a035a0-81a0-772f-b759-7cdd0359fd93/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/en-exodus-wallet.co.com - Certificate Transparency search: https://crt.sh/?q=%25.en-exodus-wallet.co.com - Web Archive lookup: https://web.archive.org/web/*/https://en-exodus-wallet.co.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview en-exodus-wallet.co.com is a phishing domain built to pass as an official Exodus property. It targets people who use or want to install the Exodus crypto wallet. The "en-" prefix and the look-alike .co.com ending mimic a localized brand site. PhishDestroy first flagged it on 2026-08-23. The site has been offline since 2026-09-11 and was still dead when last checked on 2026-10-19. How the scam works Sites like this copy the Exodus brand to win the trust of wallet users. They then push visitors toward a step that hands over control of their funds. Common versions ask for the wallet's recovery phrase under the pretext of "restoring" or "verifying" the wallet, or offer a tampered download of the wallet app. Anyone who supplies a recovery phrase gives the attacker full, irreversible access to every asset in that wallet. When last served, the page title read "502 — Site temporarily unavailable," an error message rather than Exodus branding, while our classification remains Exodus impersonation phishing. Evidence On VirusTotal, 13 of 90 engines flagged the domain as of 2026-09-06. The vendors include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, alphaMountain.ai, CyRadar and the Vietnamese anti-scam group Chong Lua Dao. Spamhaus lists the domain in its DBL under the phishing category. That listing matters because many mail and DNS filters block DBL entries automatically. Beyond PhishDestroy, the domain also appears on the MetaMask and SEAL blocklists, two sources focused specifically on crypto threats. Infrastructure The domain was registered through Moniker Online Services LLC. It resolved to 45.74.7.27 on the Omegatech LTD network (OMEGATECH-AS), hosted in the Netherlands. The site carried a TLS certificate, so a browser padlock would have appeared on it. That padlock says nothing about whether the site is legitimate. What to do If you typed your Exodus recovery phrase into this site, treat that wallet as compromised. Create a new wallet with a fresh phrase on a clean device and move any remaining funds there immediately. If you downloaded software from it, uninstall it and scan the device before using any wallet on it again. Only get Exodus from its official site or your platform's official app store. Remember that Exodus never asks for your recovery phrase. If you connected a wallet to this site, review and revoke any token approvals granted to unfamiliar addresses. Defenders should block the domain and its IP at DNS and proxy level and search logs for past visits around 2026-08-23 through 2026-09-11. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a035a0-81a0-772f-b759-7cdd0359fd93/ VirusTotal report: https://www.virustotal.com/gui/domain/en-exodus-wallet.co.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=en-exodus-wallet.co.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:27:47 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a035a0-81a0-772f-b759-7cdd0359fd93.png Captured: 2026-08-23 16:40:08 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:30:03Z", "uuid": "01a035a0-81a0-772f-b759-7cdd0359fd93", "scanned_at": "2026-08-24T21:15:23Z", "final_url": "https://en-exodus-wallet.co.com/", "status": 502, "ip": "45.74.7.27", "ips": [ "45.74.7.27" ], "asns": [ "202412" ], "countries": [ "US" ], "doc_hash": "68a3e32250f28658452330c38470c60d4753b6df2c4cc8eee86ba8b83eff7538", "tls": { "san": [ "*.en-exodus-wallet.co.com", "en-exodus-wallet.co.com" ], "cipher": "CHACHA20_POLY1305", "issuer": "YR1", "subject": "en-exodus-wallet.co.com", "protocol": "TLS 1.3", "valid_to": "2026-11-12T15:54:25Z", "valid_from": "2026-08-14T15:54:26Z" }, "domain_age_days": 10, "apex_age_days": 10, "tls_age_days": 10, "tls_valid_days": 89, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache/2.4.41 (Ubuntu)", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:40:04Z", "uuid": "dd574b0a-f344-4848-b5eb-fe9ca78d11d2", "scanned_at": "2026-08-27T19:18:19Z" } } ```