newexodus[.]store

The domain newexodus.store was registered on February 21, 2026 through a registrar owned by Tucows Domains Inc. DNS resolution points to the Cloudflare IP address 23.227.38.73, an AS13335 location in Canada. The site serves content over HTTPS using a Google Trust Services certificate that includes HSTS headers and supports HTTP/3. Traffic to the root URL returns an HTTP 302 redirect, a pattern commonly used to forward victims to malicious payloads. The domain appears on three independent security blocklists and has been flagged by four of ninety‑five VirusTotal scanners, while a Gridinsoft trust score registers a zero out of one hundred, indicating a high confidence of malicious intent.

Technical analysis shows the page renders a title tag reading "– New Exodus," deliberately mimicking the branding of the legitimate Exodus cryptocurrency wallet. The front‑end is built on the Shopify e‑commerce platform, and client‑side error reporting is enabled via BugSnag, suggesting the operators have access to debugging tools typically associated with sophisticated phishing kits. The presence of HSTS and HTTP/3 indicates the attackers have invested in a modern TLS configuration, likely to avoid triggering basic browser warnings and to improve the perceived legitimacy of the site.

Given the high‑risk classification and active status, defenders should block any DNS resolution to newexodus.store at the network perimeter and add the domain to web filtering and email security policies. Incident response teams should monitor for credential or private‑key submissions that reference Exodus wallet identifiers, and users should be warned not to enter recovery phrases or authentication tokens on any site matching this domain or similar variations. Continuous surveillance of the associated IP range and related Cloudflare‑hosted domains is advised, as the infrastructure may be reused for additional impersonation campaigns.