esxxoduswallet[.]versoly[.]page

This domain, esxxoduswallet.versoly.page, is actively impersonating Exodus, a cryptocurrency wallet provider, as part of a confirmed brand impersonation phishing operation. Infrastructure analysis reveals the domain resolves to 54.235.20.80, hosted on Amazon.com, Inc. infrastructure (AS14618) in the United States. The site is served via Nginx and secured with a Let's Encrypt SSL certificate (serial YE2), returning an HTTP 200 status, indicating full operational capacity. The page title, 'Exodus Wallet | Best Wallet to Buy & Sell Bitcoin,' directly mirrors legitimate Exodus branding, reinforcing the impersonation attempt. The domain is registered through Porkbun LLC and uses nameservers dns1.p02.nsone.net through dns4.p02.nsone.net. It has been flagged by three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, and is assigned a trust score of 0/100 by Gridinsoft. While four of ninety-one security vendors on VirusTotal have detected the domain as malicious, the absence of broader detection does not diminish its confirmed status as an active threat. No specific phishing kit or additional technical artifacts have been identified at this time, though the domain's structure and hosting environment align with known cryptocurrency-focused phishing campaigns. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. Given its active status and direct targeting of cryptocurrency users, organizations handling digital asset transactions should ensure endpoint protection and network-level controls are updated to prevent exposure. Further analysis of the site's content and backend infrastructure may reveal additional indicators of compromise, but current evidence is sufficient to classify this as a confirmed phishing domain.