cea34bb0-25b1-43a2-8c75-cf425393894f[.]exodus-request[.]com

This domain is classified as a high-risk brand impersonation threat targeting Exodus, a cryptocurrency wallet provider. Analysis indicates the site was designed to deceive users into disclosing sensitive credentials, including wallet recovery phrases or private keys, by mimicking the legitimate Exodus interface. The threat type aligns with credential harvesting and cryptocurrency theft, leveraging social engineering tactics to exploit trust in the Exodus brand. Infrastructure analysis reveals the domain cea34bb0-25b1-43a2-8c75-cf425393894f.exodus-request.com was registered on July 18, 2025, through Dynadot LLC. It resolves to the IP address 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on three security blocklists and is flagged by 16 out of 95 security vendors on VirusTotal, including detections for phishing. Google Safe Browsing categorizes it as a phishing threat, and the page title explicitly mirrors the impersonated brand (exodus-request.com). No SSL certificate was detected, further reducing the domain's legitimacy. The domain is currently offline, but its infrastructure and registration details remain relevant for historical and forensic analysis. Mitigation steps for this threat type include immediate blacklisting of the domain and its associated IP (199.59.243.228) across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain name, IP address, and registrar details (Dynadot LLC) into endpoint detection and response (EDR) systems, firewalls, and email security gateways. Users who may have interacted with the domain should be instructed to rotate credentials, particularly cryptocurrency wallet recovery phrases, and monitor for unauthorized transactions. Security teams should conduct retrospective analysis to identify any prior communications or redirects to this domain within their environments. Given the high-risk nature of this impersonation, proactive threat hunting for similar domains registered through the same registrar or resolving to the same IP range is recommended.