exodus[.]com[.]merge[.]gcasociados[.]com[.]mx

Analysis indicates that the domain exodus.com.merge.gcasociados.com.mx was registered on 21 February 2026 through the registrar AKKY ONLINE SOLUTIONS, S.A. DE C.V. The domain resolves to the IPv4 address 67.23.231.170, which is allocated to AS33182 HostDime.com, Inc. and geolocated in the United States. The authoritative nameservers dns33344.dizinc.com and dns33345.dizinc.com are consistent with the registrar's hosting services. TLS is provided by a Let’s Encrypt certificate (R13), confirming that the site was reachable over HTTPS.

An HTTP request returns a 200 status code and the page title “Index of /”, while the underlying web server is identified as Apache HTTP Server. The campaign targets the cryptocurrency wallet provider Exodus, as indicated by the brand impersonation label and the crypto‑scam classification. VirusTotal reports four detections out of ninety‑three scanning engines, and the domain is presently listed on three external blocklists, including PhishDestroy, MetaMask, and SEAL, which have taken the site offline. A Gridinsoft trust score of zero further reflects a malicious reputation.

The available evidence confirms the presence of a brand‑impersonation operation aimed at deceiving Exodus users, likely to harvest credentials or private keys. Uncertainty remains regarding the specific payload or credential‑collection mechanism, as the page content is limited to a directory listing without additional forensic detail. Defenders should add the domain and its associated IP address to internal blocklists, monitor DNS queries for the domain and its nameservers, and enforce SSL pinning or certificate verification for Exodus services. Continuous re‑query of VirusTotal and other reputation services is advised to capture any changes in detection status while the domain remains offline.