exodus-io.org

PhishDestroy first observed exodus-io.org on Sep 13, 2026. The hostname explicitly references Exodus; stored content metadata identifies the same apparent target. Stored page analysis classifies the content as impersonation. Current evidence score: 95/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, MetaMask, SEAL, and Spamhaus DBL. VirusTotal recorded 15 detections among 89 engines: alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, Sophos, VIPRE, Webroot on Sep 21, 2026 at 07:40 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Sep 21, 2026 at 14:20 UTC. Spamhaus DBL: DBL_PHISH on Sep 19, 2026 at 18:30 UTC. Non-positive and contextual checks: AlienVault OTX listed 6 community pulse references (not vendor detections) on Sep 21, 2026 at 07:41 UTC. Google Safe Browsing returned no flag on Sep 21, 2026 at 07:40 UTC. A URLScan capture is available, but no capture timestamp was recorded.

No conclusive timestamped HTTP response is stored. Registration records for the domain list Hosting Concepts B.V. d/b/a Registrar.eu as the registrar and Sep 5, 2026 as the creation date. Registration preceded first observation by 7 days. At collection time, the hostname resolved to 87.120.196.112 on AS198550 (nodehost-as NODE HOST LIMITED, GB). The recorded endpoint location is Helsinki, FI. The stored server header is nginx. The evidence archive retains 1 visual capture from URLScan; no page title was retained, so the captures preserve the landing-page appearance.

The content indicators and 4 positive source findings support the current Exodus-themed impersonation classification.