recover-exodus[.]top

PhishDestroy has identified recover-exodus.top as an active cryptocurrency drainer posing as an Exodus wallet recovery portal. The domain leverages social engineering tactics to trick users into entering seed phrases or private keys under the guise of restoring lost wallet access. Security researchers have classified this as a generic phishing campaign with a clear financial motive, targeting individuals with substantial crypto holdings. The infrastructure appears to be a lightweight phishing kit rather than a sophisticated malware strain, focusing on immediate credential theft rather than persistence. This domain was registered through NameSilo, LLC on March 29, 2026, and resolves to IP address 64.187.97.203. VirusTotal reports a detection ratio of 2 out of 95 security vendors, indicating limited but present awareness within the threat intelligence community. The SSL certificate, issued by Let's Encrypt, suggests an attempt to appear legitimate, though the domain itself is only days old at the time of analysis. No known inclusion in Google Safe Browsing (GSB) lists or major blocklists has been confirmed as of this assessment, which may contribute to its transient effectiveness. As of this advisory, recover-exodus.top remains active and poses an elevated risk to uninformed users. Immediate defensive actions include blocking the domain at DNS and network levels, flagging the associated IP in firewall rules, and updating browser-based blocklists. While the current detection rate is low, the domain's recent creation and narrow targeting suggest it may evade widespread recognition temporarily. Users are strongly advised to verify wallet URLs through official Exodus channels and implement multi-factor authentication where possible. The risk remains elevated until broader threat intelligence coverage is achieved.