exxodus[.]co[.]com

Analysis of exxodus.co.com shows a newly registered domain (creation date 21 February 2026) that is currently offline but was previously resolved to the IP address 188.114.96.3, hosted by Cloudflare (AS13335) in the United States. The site presented a page titled "Just a moment..." and was associated with a brand impersonation campaign targeting the cryptocurrency wallet provider Exodus. The SSL certificate presented for the domain is identified as "WE1," indicating a likely self‑signed or low‑trust certificate.

Threat intelligence indicates that one of ninety‑three VirusTotal scanners flagged the domain, suggesting at least minimal malicious behavior despite a low detection count. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the view that it was used for phishing or fraudulent activity. While the offline status prevents live verification of payloads or page content, the combination of a recent registration, Cloudflare edge hosting, a generic page title, and the brand‑impersonation label provides sufficient evidence for a elevated risk rating.

Defenders should continue to block DNS resolution to 188.114.96.3 for this FQDN, monitor for any re‑registration attempts, and add the domain to internal deny lists. Additional scrutiny of traffic logs for any historic connections to this host is advised, as is verification that endpoint security solutions correctly flag the single VirusTotal detection. Until the domain is taken down permanently, it remains a potential vector for credential harvesting against Exodus users.