esixodswalletxi[.]webflow[.]io

Analysis indicates that the domain esixodswalletxi.webflow.io is actively engaged in brand impersonation targeting Exodus, a cryptocurrency wallet provider. The domain was registered through MarkMonitor, Inc., and remains operational as of July 12, 2026. Infrastructure analysis reveals resolution to the IP address 104.18.36.248, with hosting facilitated by Cloudflare and content delivery via Webflow. The page title, 'Exodus® Wallet*: A Comprehensive Solution - Webflow,' explicitly references the Exodus brand, reinforcing the impersonation intent. Detection metrics show the domain appears on one security blocklist, and 17 of 95 security vendors on VirusTotal have flagged it as malicious. The Gridinsoft trust score for this domain is 0/100, further supporting its classification as high-risk. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains, providing no definitive indication of intent. The domain's creation date of May 8, 2013, is notably older than typical phishing domains, which may suggest either a compromised legitimate domain or an attempt to evade detection through aged infrastructure. However, the current activity aligns with phishing campaigns targeting cryptocurrency users. Defenders are advised to block the domain and associated IP at the network level, monitor for further indicators of compromise, and alert users to the presence of this impersonation attempt. The exact content and functionality of the site remain unanalyzed, but the combination of brand reference, detection counts, and hosting infrastructure warrants immediate mitigation.