exodulogjuiui[.]gitbook[.]io

This domain, exodulogjuiui.gitbook.io, is actively serving a credential‑phishing campaign that impersonates the Exodus brand. The site was originally registered on 30 March 2014 through Cloudflare, Inc., and continues to use Cloudflare’s infrastructure; DNS resolves to 104.18.40.47, an address owned by AS13335 Cloudflare, Inc. in the United States. The domain is fronted by Cloudflare’s DNS service (dahlia.ns.cloudflare.com, hugh.ns.cloudflare.com) and delivers traffic over HTTP/3 with a 307 redirect response. TLS termination is handled by a Google Trust Services certificate (WE1), indicating a valid‑looking HTTPS connection. The page title returned by the server reads “Exodus® Login*: A Comprehensive Solutionage | us”, directly referencing Exodus and suggesting a login‑capture page. Independent security vectors have already flagged the domain: it appears on three blocklists, is blocked by PhishDestroy, MetaMask, and SEAL, and 17 of 91 VirusTotal scanners have marked it malicious. The combination of brand impersonation, credential‑phishing intent, and persistent active status elevates its risk to high. Defenders should add the domain to deny‑list rules, monitor for any traffic to the associated IP, and enforce strict verification of Exodus‑related communications. Continuous observation of changes to DNS records or certificate details is also advised.