exoduswoletx[.]webflow[.]io

Analysis of exoduswoletx.webflow.io shows a recently registered domain (created 12 March 2026) that mimics the Exodus brand, as indicated by the page title “Exodus® Wallet*!! A Comprehensive Solution - Webflow”. The site was hosted on the Webflow platform and served through Cloudflare’s network (IP 104.18.36.248, AS13335, United States). HTTPS was provided by Google Trust Services under the WE1 certificate, and the connection employed HTTP/3. An HTTP request returned a 404 status, suggesting the landing page is no longer reachable, and the domain has been taken offline according to current observations.

Threat intelligence feeds have classified the domain as a crypto‑related brand impersonation. Ten of ninety‑four VirusTotal scanners flagged the host, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already listed it as malicious. The presence on multiple blocklists, combined with the explicit brand targeting, confirms a high‑risk profile. No additional infrastructure such as command‑and‑control servers or malware payloads has been disclosed, and the exact content of the removed page cannot be verified. Defenders should continue to block the domain at perimeter filters and DNS resolvers, especially those protecting cryptocurrency wallets.

Monitoring for new subdomains under the same registrar (Webflow) and for activity originating from the same Cloudflare IP range is advisable. Because the SSL certificate is legitimate and the hosting service is a reputable SaaS provider, detection should rely on reputation signals rather than certificate anomalies. Organizations using the Exodus wallet should alert users to the existence of this impersonation attempt and advise verification of URLs before credential entry. Ongoing vigilance is required in case the operators reactivate the domain or launch similar impersonation sites.