exodus-wallet[.]org

Analysis of exodus-wallet.org shows a domain that was actively used for a crypto‑related scam targeting the Exodus brand and has since been taken offline. The domain resolves to IP address 188.114.96.3, which is hosted in the United States under ASN 13335 belonging to Cloudflare, Inc. No SSL certificate is presented, meaning the site was delivered over plain HTTP. Registration data indicate the domain was created on 22 November 2025 and was registered through Web Commerce Communications Limited. The authoritative nameservers are christina.ns.cloudflare.com and derek.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure. Reputation services provide divergent scores: Gridinsoft rates it at 0 out of 100, while Scamadviser assigns a modest 46 out of 100, reflecting limited confidence in the site’s legitimacy.

The domain appears on three external blocklists—PhishDestroy, ScamSniffer, and Enkrypt—reinforcing its malicious status. Threat intelligence from AlienVault OTX includes the domain in a single pulse, indicating it has been observed by at least one community source. VirusTotal scans report that six of ninety‑three security vendors flagged the domain, confirming that a subset of scanners recognize malicious behavior. The site’s only visible page title is the Hebrew phrase “רק רגע…”, and no additional content has been disclosed.

Defenders should immediately block traffic to 188.114.96.3 and add exodus-wallet.org to internal URL filtering lists. Monitoring of newly registered domains that reference the Exodus brand is advised, as the rapid creation date suggests a short‑lived campaign. Given the lack of SSL, the offline status, and the presence on multiple blocklists, the domain is classified as an elevated‑risk crypto scam. Continuous threat intel feeds should be consulted for any resurgence or related infrastructure reuse.