exoduswarranty[.]com

Analysis of exoduswarranty.com indicates an active phishing domain targeting users of the Exodus cryptocurrency wallet. The domain, registered on March 10, 2026, through Name.com, Inc., resolves to the IP address 34.111.179.208, hosted on Google Cloud infrastructure. Detected technologies include Node.js, Express, Google Cloud Trace, and HTTP/3, alongside HSTS and Google Cloud CDN, suggesting a professionally configured environment designed to appear legitimate. The page title, 'Secure Phrase Submission,' directly aligns with tactics used to harvest sensitive wallet recovery phrases, a critical vector for cryptocurrency theft. Threat intelligence aggregators have flagged this domain in 23 distinct pulses, and it appears on four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. Fourteen of 95 security vendors on VirusTotal detect the domain as malicious. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate the site's legitimacy. The domain's creation date, recent but not anomalous for phishing campaigns, and its continued operational status further support its classification as a high-risk threat. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activities occur. Given the explicit targeting of Exodus wallet users, organizations should also alert users to the risks of entering recovery phrases or private keys on unverified platforms. While the exact content and functionality of the site remain unanalyzed, the combination of infrastructure, page title, and threat intelligence confirms its malicious intent. No evidence suggests this domain is affiliated with the legitimate Exodus brand.