exodus-recovery[.]app

The domain exodus-recovery.app is currently active and classified as a high‑risk brand‑impersonation threat targeting the cryptocurrency wallet provider Exodus. The site presents the page title "Exodus – Import Wallet" and is explicitly linked to the brand target Exodus. Registration data indicates the domain was created on December 27, 2025, and it resolves to the IPv4 address 196.251.70.176, which geolocates to the Netherlands. The domain is hosted behind Cloudflare, Inc. infrastructure, using the nameservers augustus.ns.cloudflare.com and laura.ns.cloudflare.com, and it serves content over HTTP with a 200 response code. No SSL certificate is observed, meaning communications are unencrypted. The site has been listed on two public security blocklists—PhishDestroy and PhishingDB—and appears in eighteen AlienVault OTX threat pulses, underscoring its recognition across multiple intelligence sources. VirusTotal scans have resulted in 17 out of 95 security vendors flagging the domain as malicious, while reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The observed indicators collectively support the designation of the domain as a seed_phish campaign designed to harvest credentials or private keys from unsuspecting Exodus users. While the external page content has not been directly analyzed, the presence of a brand‑specific title and the alignment with known phishing tactics suggest a deliberate impersonation attempt. Defenders should prioritize immediate blocking of exodus-recovery.app at perimeter and DNS layers, incorporate the associated IP address and Cloudflare nameservers into threat‑feed updates, and monitor for any derivative domains that reuse the same registration pattern or resolve to the same host. Continuous verification against the latest blocklist entries and periodic VirusTotal rescans are recommended to capture any evolution in the domain's malicious payload or infrastructure.