# PhishDestroy domain threat record: mr-exodus.co.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/mr-exodus.co.com/ Machine-readable companion: https://phishdestroy.io/domain/mr-exodus.co.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-23 16:40:08 UTC - Last availability or vendor check: 2026-10-21 22:32:51 UTC - Stored record updated: 2026-10-22 14:23:28 UTC - VirusTotal detections in the stored snapshot: 3/90 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Exodus ## Stored infrastructure - Observed IP address: 172.67.177.144 - Registrar in stored WHOIS data: Moniker Online Services LLC - Registration date (registry RDAP, co.com): 1997-08-16 04:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a036d4-512e-718f-bf9e-b89198216760/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mr-exodus.co.com - Certificate Transparency search: https://crt.sh/?q=%25.mr-exodus.co.com - Web Archive lookup: https://web.archive.org/web/*/https://mr-exodus.co.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview mr-exodus.co.com is an impersonation phishing page posing as Exodus, the popular self-custody bitcoin and crypto wallet. It targets Exodus users and people searching for the wallet, using the brand in the hostname and Exodus's own marketing line as its page title. PhishDestroy first saw it on 2026-08-23. The site has been offline since 2026-09-11 and was still unreachable when last checked on 2026-10-19. How the scam works The page presented itself under the title "Exodus: the world's leading bitcoin and crypto wallet" to pass as the official site at a glance. The domain adds a "mr-" prefix and uses the co.com ending, which reads like a normal .com address. Fake Exodus pages of this kind usually push a counterfeit wallet download or a "restore" or "verify" form that asks for the 12-word secret recovery phrase. Because Exodus is non-custodial, anyone holding that phrase controls the wallet outright and can empty it with no way to reverse the transfers. Evidence urlscan.io rated the page malicious and recognised Exodus branding on it. Spamhaus lists the domain in its DBL as phishing, and it appears on the MetaMask and SEAL blocklists as well as PhishDestroy's. VirusTotal coverage was thin: on 2026-09-06 only 3 of 90 engines flagged it, namely alphaMountain.ai, Forcepoint ThreatSeeker and Gridinsoft. A clean result from most antivirus engines would therefore not have meant the site was safe. Infrastructure The domain was registered through Moniker Online Services LLC. It sat behind Cloudflare's network in the US, which conceals the server that actually hosted the page. Its certificate came from WE1, a free automated issuer, so the padlock in the browser only showed an encrypted connection and said nothing about who ran the site. What to do If you typed your Exodus recovery phrase into this site, treat the wallet as compromised. Create a new wallet with a fresh phrase on a clean device and move any remaining funds immediately. If you downloaded an "Exodus" app from it, uninstall it, scan the device, and reinstall Exodus only from the official site or your platform's official app store. Never share your recovery phrase with any website, form or support agent. Defenders should block the domain, watch for other Exodus lookalikes on co.com and similar endings, and report new copies to PhishDestroy and Exodus. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a036d4-512e-718f-bf9e-b89198216760/ VirusTotal report: https://www.virustotal.com/gui/domain/mr-exodus.co.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mr-exodus.co.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:27:47 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a036d4-512e-718f-bf9e-b89198216760.png Captured: 2026-08-23 16:40:08 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:30:03Z", "uuid": "01a036d4-512e-718f-bf9e-b89198216760", "scanned_at": "2026-08-25T02:51:35Z", "final_url": "https://exodus-login.com/", "status": 200, "redirected": "off-domain", "redirects": [ { "to": "https://exodus-login.com/", "from": "https://mr-exodus.co.com/" }, { "to": "https://exodus-login.com/", "from": "https://exodus-login.com/", "status": 302 } ], "ip": "172.67.177.144", "domains": [ "ctr.a.exodus.io", "ct-cdn.a.exodus.io", "region1.google-analytics.com", "prod.spline.design", "ws.hotjar.com", "content.hotjar.io", "vc.hotjar.io", "script.hotjar.com", "static.hotjar.com", "www.googletagmanager.com", "mr-exodus.co.com", "www.exodus.com" ], "ips": [ "216.239.34.36", "2600:9000:223c:e600:1f:574b:600:93a1", "108.133.183.145", "18.66.112.15", "2606:4700:4406::ac40:9543", "65.9.130.6", "2a06:98c1:3104::6812:26bd", "2001:4860:4802:32::36", "18.66.102.51", "2a00:1450:4001:c0f::61", "172.67.177.144", "45.74.7.27" ], "asns": [ "15169", "16509", "13335", "202412" ], "countries": [ "US", "IE", "DE" ], "doc_hash": "573be0e8caf4b6ce5f7ce5d54f33b73a6f12ca17ce2b01e90f7b0e7eba1bf04e", "script_hashes": [ "7ce1ffca3e7b175ff94c55be3bcd39e06d4efadd305172ec41f0d939d6e7ea46", "359deca4a1b7762a78f0fd35eafb5f746e88a2e793056c0e1e2b819d83f8c0fa", "299e5d5ef25c285dfd37e2870361993367afde758245b7a22022e0a13420e0ee", "f7d5805071933eafa415dcee50b102149f1177d85a24d87fcc4501003157b37c", "3d68eb2553b28f0f6479fed3ab1cada9b3707f8a5e865ade83be29de8ac14695", "b7b850fe376b14fd3576b704e3663d5d8f19405482d50e7a78288e1f4301d079", "db554cac94b582ff90d617f68c243c944092f131842c6b6b5884388f1c0f4910", "bed95b1de3f36720f300a1112ea0a0cf7eb4f3f16028540c3eb54685cc7777f1", "9d8a0971b45d23a50a94473d4e0bd2a4dbc90d0e28a4b8ce85b595d6a4e27a67", "b3da6898d41d7decc4b5ffa5500f2435463baed0cce25211ba962996923a348d" ], "globals": [ "modifyLinks", "__next_f", "webpackChunk_N_E", "next", "lenisVersion", "gtag", "dataLayer", "hj", "_hjSettings", "google_tag_data", "google_tag_manager", "onYouTubeIframeAPIReady", "gaGlobal", "__THREE__", "hjSiteSettings", "hjLazyModules", "hjBootstrap", "hjBootstrapCalled" ], "cookies": [ "__cf_lb", "ac_tk", "_ga", "_hjSessionUser_5011428", "_ga_SXL70E35DQ", "_hjSession_5011428", "__cf_bm", "_cfuvid" ], "storage_keys": [ "newsletter_has_visited", "asset-search-cache-v1", "_hjSessionStorageTest", "_hjLocalStorageTest", "hjViewportId", "hjActiveViewportIds" ], "tls": { "san": [ "*.mr-exodus.co.com", "mr-exodus.co.com" ], "cipher": "CHACHA20_POLY1305", "issuer": "YR2", "subject": "mr-exodus.co.com", "protocol": "TLS 1.3", "valid_to": "2026-11-18T17:46:34Z", "valid_from": "2026-08-20T17:46:35Z" }, "domain_age_days": 1336, "apex_age_days": 1336, "tls_age_days": 12, "tls_valid_days": 90, "requests": 126, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 80, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "exodus" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Exodus Wallet" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Microsoft-IIS/10.0", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:40:02Z", "uuid": "d395f66f-da70-4eca-84f1-4cb90c834802", "scanned_at": "2026-08-27T19:18:17Z" } } ```