# PhishDestroy domain threat record: exodustradingai.click Content language: English Canonical HTML report: https://phishdestroy.io/domain/exodustradingai.click/ Machine-readable companion: https://phishdestroy.io/domain/exodustradingai.click/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 00:27:35 UTC - Stored record updated: 2026-10-26 01:00:10 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Exodus ## Stored infrastructure - Observed IP address: 188.114.97.1 - Registrar in stored WHOIS data: Spaceship, Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-10 05:49:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0b3ef-9a1c-745b-b796-338c3998d0d0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/exodustradingai.click - Certificate Transparency search: https://crt.sh/?q=%25.exodustradingai.click - Web Archive lookup: https://web.archive.org/web/*/https://exodustradingai.click/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed exodustradingai.click as a suspicious domain because multiple VirusTotal vendors marked it malicious or suspicious. The recorded page title "Exodus Trading AI | a premium AI | Official Web Platform" references the Exodus brand but provides no proof of affiliation. The domain was first seen by PhishDestroy on 2026-10-26 and returned an HTTP 200 response at that time. How the scam works No specific fraud behavior was observed on the page, but domains that attract many malicious vendor detections are often used to lure visitors with false financial or AI‑trading promises and harvest credentials or funds. Such sites typically imitate reputable brands to create trust and encourage users to submit sensitive information. Evidence VirusTotal scanned the domain on 2026-10-20, reporting 14 malicious and 3 suspicious detections out of 92 engines (17 total detections). Google Safe Browsing checked on 2026-10-26 and did not flag the site. urlscan.io captured the page on 2026-09-18; its overall verdict was clean, while its engine analysis gave a malicious score of 99. OTX listed one pulse referencing the domain as of 2026-10-26. PhishDestroy’s internal blocklist marks the domain as malicious, and external blocklists showed zero hits on the same date. Infrastructure The domain was registered with Spaceship, Inc. on 2026-09-10 and expires on 2027-09-10. Hosting is provided through Cloudflare, with recorded IPv4 addresses 188.114.97.1 (and related IPv6) and a TLS certificate issued by Google Trust Services valid from 2026-09-10 to 2026-12-09. The certificate’s SAN includes exodustradingai.click and the recorded country for the network is GB. What to do Visitors should avoid entering any credentials, personal data, or cryptocurrency information on the site and should change passwords only if they suspect they have been submitted. Security teams can block exodustradingai.click at the firewall or DNS level, monitor logs for connections to the recorded Cloudflare IPs, and keep the domain under observation for any future intelligence updates. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0b3ef-9a1c-745b-b796-338c3998d0d0/ Cloudflare Radar report: https://radar.cloudflare.com/scan/e1ccdee7-682e-477d-9936-bf99a027aab1 Stored capture screenshot: https://urlscan.io/screenshots/01a0b3ef-9a1c-745b-b796-338c3998d0d0.png Cloudflare Radar screenshot (2026-10-26T00:33:32Z): https://screenshots.phishdestroy.io/cf/e1ccdee7-682e-477d-9936-bf99a027aab1.png URLScan screenshot (2026-09-10T19:33:28Z): https://screenshots.phishdestroy.io/us/01a08ccf-7850-720d-b7bc-3e65c60db396.png URLScan capture report: https://urlscan.io/result/01a08ccf-7850-720d-b7bc-3e65c60db396/ URLScan screenshot (2026-09-13T16:26:01Z): https://screenshots.phishdestroy.io/us/01a09b96-ed0b-7149-a25e-ef1c0b40798d.png URLScan capture report: https://urlscan.io/result/01a09b96-ed0b-7149-a25e-ef1c0b40798d/ URLScan screenshot (2026-09-14T03:50:37Z): https://screenshots.phishdestroy.io/us/01a09e09-60b8-73d8-8187-2b2abbe04d5d.png URLScan capture report: https://urlscan.io/result/01a09e09-60b8-73d8-8187-2b2abbe04d5d/ URLScan screenshot (2026-09-14T08:41:23Z): https://screenshots.phishdestroy.io/us/01a09f13-e61a-733c-a880-2e5a93111c26.png URLScan capture report: https://urlscan.io/result/01a09f13-e61a-733c-a880-2e5a93111c26/ URLScan screenshot (2026-09-17T17:01:44Z): https://screenshots.phishdestroy.io/us/01a0b051-125a-7575-a9c2-89fd2c422b4b.png URLScan capture report: https://urlscan.io/result/01a0b051-125a-7575-a9c2-89fd2c422b4b/ URLScan screenshot (2026-10-26T00:32:56Z): https://screenshots.phishdestroy.io/us/01a1759f-c01d-7393-b09c-3593b8a34eb4.png URLScan capture report: https://urlscan.io/result/01a1759f-c01d-7393-b09c-3593b8a34eb4/ VirusTotal report: https://www.virustotal.com/gui/domain/exodustradingai.click Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=exodustradingai.click Archived copy: https://web.archive.org/web/20261026002849/https://exodustradingai.click/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 00:38:36 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0b3ef-9a1c-745b-b796-338c3998d0d0.png Captured: 2026-10-26 00:27:35 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0b3ef-9a1c-745b-b796-338c3998d0d0.png Source report: https://urlscan.io/result/01a0b3ef-9a1c-745b-b796-338c3998d0d0/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e1ccdee7-682e-477d-9936-bf99a027aab1.png Captured: 2026-10-26 00:33:32 UTC Source report: https://radar.cloudflare.com/scan/e1ccdee7-682e-477d-9936-bf99a027aab1 SHA-256: 14ef5299551c15459b5bca7bb77793f0ecc3677f30d6c292f955d7310da456d1 - URLScan · 2026-09-10: https://screenshots.phishdestroy.io/us/01a08ccf-7850-720d-b7bc-3e65c60db396.png Captured: 2026-09-10 19:33:28 UTC Source report: https://urlscan.io/result/01a08ccf-7850-720d-b7bc-3e65c60db396/ SHA-256: 43b1cea47b337a4fa3435c3f1e1553a0098894d50256824a56a2855b69a6d523 - URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09b96-ed0b-7149-a25e-ef1c0b40798d.png Captured: 2026-09-13 16:26:01 UTC Source report: https://urlscan.io/result/01a09b96-ed0b-7149-a25e-ef1c0b40798d/ SHA-256: c25768bf524d1aa9cd7598a7cd7acf7fc5a764cc0807f4edc0ddd695442a744d - URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09e09-60b8-73d8-8187-2b2abbe04d5d.png Captured: 2026-09-14 03:50:37 UTC Source report: https://urlscan.io/result/01a09e09-60b8-73d8-8187-2b2abbe04d5d/ SHA-256: 4ac0457e60a019b216fe819abb2286ee7b36385ea1119e0ae1d3ce128b7af2b9 - URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09f13-e61a-733c-a880-2e5a93111c26.png Captured: 2026-09-14 08:41:23 UTC Source report: https://urlscan.io/result/01a09f13-e61a-733c-a880-2e5a93111c26/ SHA-256: fbfcad76ec53ec3539d436302eb52d303c24b485800991e8d432d86accfc8eaa - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0b051-125a-7575-a9c2-89fd2c422b4b.png Captured: 2026-09-17 17:01:44 UTC Source report: https://urlscan.io/result/01a0b051-125a-7575-a9c2-89fd2c422b4b/ SHA-256: be95d5cd28a419eb0a2952f1d7eff95fddb7fc0d2c54bfa41caf844c95c2c43a - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1759f-c01d-7393-b09c-3593b8a34eb4.png Captured: 2026-10-26 00:32:56 UTC Source report: https://urlscan.io/result/01a1759f-c01d-7393-b09c-3593b8a34eb4/ SHA-256: 176adc966defeab067b8ddecf585e5acc5d247c3b37b578aaf0814e8a60f6d95 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T00:37:24Z", "uuid": "01a0b3ef-9a1c-745b-b796-338c3998d0d0", "scanned_at": "2026-09-18T09:53:46Z", "final_url": "https://exodustradingai.click/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://exodustradingai.click/", "from": "http://exodustradingai.click/", "status": 307 } ], "ip": "188.114.96.3", "domains": [ "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com" ], "ips": [ "104.17.207.5", "74.125.29.95", "104.17.24.14", "188.114.96.3" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "doc_hash": "db04a1cb797f227e30a7d777f2434e6d9699966ea945e5dfbb39e7b63a1bcb39", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_w3n3qlx6", "toggleTermsPopup", "__cfQR", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "exodustradingai.click" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "exodustradingai.click", "protocol": "TLS 1.3", "valid_to": "2026-12-09T09:08:06Z", "valid_from": "2026-09-10T08:08:11Z" }, "domain_age_days": 8, "apex_age_days": 8, "tls_age_days": 8, "tls_valid_days": 90, "requests": 16, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; default-src 'self'; font-src 'self' https://fonts.gstatic.com https://cdnjs.clou", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T00:37:26Z", "uuid": "e1ccdee7-682e-477d-9936-bf99a027aab1", "scanned_at": "2026-10-26T00:33:32Z", "final_url": "https://exodustradingai.click/", "status": 200, "history": [ { "url": "https://exodustradingai.click/", "status": 200 } ], "dom_hash": "941a2645180707dcdb1dc0e0cd8da542804e1d8abd105e70f9f990faf86cc9cd", "doc_hash": "07f629683b22c904830b05537c258188f97e854aa3aacde9b25bee7f3db9685b", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "exodustradingai.click", "type": "A", "value": "188.114.97.0" }, { "name": "exodustradingai.click", "type": "A", "value": "188.114.96.0" }, { "name": "exodustradingai.click", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "exodustradingai.click", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Spaceship, Inc.", "created": "2026-09-10T07:49:00Z", "updated": "2026-09-15T07:49:51Z", "expires": "2027-09-10T07:49:00Z", "nameservers": [ "gabriella.ns.cloudflare.com", "armfazh.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T00:32:01Z", "analysis_at": "2026-10-20T03:49:51Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 14, "suspicious": 3, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "LevelBlue": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Spaceship, Inc.", "created": "2026-09-10T07:49:00Z", "expires": "2027-09-10T07:49:00Z", "updated": "2026-09-15T07:49:51Z", "first_seen": "2026-09-10T10:32:26Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "armfazh.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "armfazh.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:2dba" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::ac43:da42" }, { "ttl": 300, "type": "A", "value": "172.67.218.66" }, { "ttl": 21600, "type": "NS", "value": "gabriella.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.45.186" } ], "dns_at": "2026-10-20T03:57:40Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "exodustradingai.click" ], "issuer": "Google Trust Services / WE1", "serial": "62d038f65d01da7c0eee46d90cf6005e", "sha256": "6d0aaac9012853b226f8e352de2a8ef486e247a676a289e9c4d40786d354ce4e", "subject": "exodustradingai.click", "valid_to": "2026-12-09T09:08:06Z", "valid_from": "2026-09-10T08:08:11Z" }, "whois": { "registrar": "Spaceship, Inc.", "registrar_iana_id": "3862", "registrar_url": "https://www.spaceship.com/", "created": "2026-09-10T07:49:00Z", "updated": "2026-09-15T07:49:51Z", "expires": "2027-09-10T07:49:00Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "armfazh.ns.cloudflare.com", "gabriella.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited", "add period" ], "events": { "last changed": "2026-09-10T09:00:18Z", "registration": "2026-09-10T07:49:00Z", "registrar expiration": "2027-09-10T07:49:00Z", "last update of RDAP database": "2026-10-18T03:45:50Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T00:37:42Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "exodustradingai.click" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T00:28:49Z", "first": "2026-09-10T09:15:03Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.02, "avg_page_bytes": 42953 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://exodustradingai.click/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 140 }, "social_tags": { "ogUrl": "https://exodustradingai.click/", "title": "Exodus Trading AI | a premium AI | Official Web Platform", "ogType": "website", "robots": "index, follow", "ogTitle": "Exodus Trading AI | Premium AI-Driven Trading Operations", "ogSiteName": "Exodus Trading AI", "themeColor": "#fff8f3", "description": "Exodus Trading AI delivers a premium, holographic fintech experience with AI-driven trading guidance and automated bots, featuring structured workflows, robust controls, and transparent risk tooling.", "twitterCard": "summary", "canonicalUrl": "https://exodustradingai.click/", "ogDescription": "Exodus Trading AI delivers a premium, holographic fintech experience with AI-driven trading guidance and automated bots, featuring structured workflows, robust controls, and transparent risk tooling." }, "trackers": { "requests": 18, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 8 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 20, "wait": 95, "connect": 6, "download": 48 }, "response_ms": 170 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 148176, "co2_grams": 0.0054, "cleaner_than": 13 }, "dns_server": { "ns": [ { "ip": "162.159.38.134", "host": "gabriella.ns.cloudflare.com" }, { "ip": "162.159.44.104", "host": "armfazh.ns.cloudflare.com" } ], "zone": "exodustradingai.click" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "exodustradingai.click" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "gabriella.ns.cloudflare.com", "armfazh.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"armfazh.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418086644, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=15552000; includeSubDomains; preload", "message": "HSTS max-age is 15552000, below the 31536000 minimum." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com;", "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://exodustradingai.click" ] }, "linked_pages": { "internal_count": 39 }, "whois": { "registrar": "Spaceship, Inc.", "created": "2026-09-10T07:49:00Z", "updated": "2026-09-15T07:49:51Z", "expires": "2027-09-10T07:49:00Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "gabriella.ns.cloudflare.com", "armfazh.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; default-src 'self'; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; scr", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```