exoduswhales[.]co[.]uk

Analysis of exoduswhales.co.uk, created on 19 May 2024 and currently active, shows a clear pattern of brand impersonation targeting the cryptocurrency platform Exodus. The domain resolves to IP address 68.168.220.124, which is hosted in the United States under ASN 19318 (Interserver, Inc). Nameservers dns3004a.trouble-free.net and dns3004b.trouble-free.net are associated with the same hosting provider, indicating a single‑point infrastructure. The site presents an SSL certificate issued by Let’s Encrypt (R12), confirming encrypted HTTPS support, and returns HTTP 200 status over HTTP/3, suggesting modern server configuration. Detected technologies include PHP, Bootstrap, LiteSpeed, Swiper, Smartsupp, Slick, jQuery, and the Swiper carousel library, all common to generic web applications and not indicative of a specific phishing kit.

The page title "Exoduswhales - Home" aligns with the declared impersonation of Exodus, and the listed scam type is a crypto scam, reinforcing the malicious intent. Reputation signals are poor: a Scamadviser trust score of 20 / 100, inclusion on one security blocklist, and a detection by PhishDestroy. VirusTotal reports two positive detections out of ninety‑five security vendors, further confirming malicious classification. The domain is registered through NameCheap, Inc., and its MX record points to the domain itself, a typical configuration for malicious email harvesting. While the visible content has not been examined, the available telemetry confirms an active infrastructure dedicated to deceiving users of the Exodus brand.

Uncertainties remain regarding the specific payload or credential collection mechanisms employed, as no page‑level analysis or malicious URL paths are provided. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to 68.168.220.124, and add the domain to threat intel feeds.