devicecheck-us-exodus[.]com

This domain, devicecheck-us-exodus.com, is confirmed to operate as a brand impersonation site targeting Exodus crypto wallet users. Analysis indicates the site presents a fraudulent interface designed to harvest wallet credentials, seed phrases, or private keys under the pretense of account verification or security updates. The threat specifically exploits trust in the Exodus brand to deceive users into disclosing sensitive authentication details, which could lead to unauthorized access and asset theft from connected wallets. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, and resolves to IP address 190.97.166.172, located in Panama under AS27956 (Cyber Cast International, S.A.). Security vendors have flagged the domain on VirusTotal, with 9 out of 95 engines detecting malicious activity. Additionally, the domain appears on three independent security blocklists, and its SSL certificate is issued by Let's Encrypt (R13). The page title, 'Account Suspended,' is a common social engineering tactic used to create urgency and prompt victims to enter credentials. Users who visited devicecheck-us-exodus.com should immediately revoke any permissions granted to connected wallets or applications. If credentials, seed phrases, or private keys were entered, the affected wallet should be considered compromised, and all funds should be transferred to a new, secure wallet. Monitor transaction history for unauthorized activity and report the incident to relevant security teams. Avoid interacting with any links or prompts from the domain, and verify all communications through official Exodus channels only.