# exodus-renew-cancel.com — MALICIOUS

> Avoid exodus-renew-cancel.com, a phishing site mimicking Exodus wallet. Do not enter credentials or personal info on this suspicious domain.

## Summary
PhishDestroy has identified exodus-renew-cancel.com as a medium-risk brand impersonation threat targeting users of the Exodus Bitcoin and crypto wallet. The domain seeks to deceive victims by presenting itself as a legitimate service for renewing or canceling Exodus accounts.

This domain was registered on March 2, 2026 through NameCheap, Inc., and resolved to IP address 66.29.141.3. It was flagged by 6 out of 95 security vendors on VirusTotal and appeared on 2 separate security blocklists, indicating suspicious activity. The website’s page title mimics the official Exodus wallet interface to enhance its credibility.

Currently, exodus-renew-cancel.com has been taken offline. Users are advised not to visit or interact with this domain if encountered. Organizations should update their security filters to block this URL and educate users on verifying official Exodus communications to prevent credential theft.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Target brand: Exodus
- Page title: Exodus - Bitcoin and Crypto Wallet

## Domain Intelligence
- Registered: 2026-03-02 15:00:01
- Registrar: NameCheap, Inc.
- Country: US
- IP: 66.29.141.3
- IP Country: US
- IP City: Phoenix
- IP Org: AS22612 Namecheap, Inc.
- Nameservers: dns1.namecheaphosting.com dns2.namecheaphosting.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 6 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "CyRadar", "Kaspersky", "Seclookup", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://i.ibb.co/1GHtqYhX/9df437ebd54c.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/1c4a2db8-68b4-4881-ac2d-965a6bc9e378
- PhishDestroy: https://phishdestroy.io/domain/exodus-renew-cancel.com/
- LLM endpoint: https://phishdestroy.io/domain/exodus-renew-cancel.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/exodus-renew-cancel.com/
Last updated: 2026-03-19