exudas-walletx[.]godaddysites[.]com

The domain exudas-walletx.godaddysites.com was registered on February 21, 2026 through GoDaddy.com, LLC. It resolves to the IP address 13.248.243.5, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. The host presents a GoDaddy Secure Certificate Authority - G2 SSL certificate issued to GoDaddy.com, Inc., confirming the use of a valid TLS certificate despite the malicious intent. HTTP probing returns a 404 status code, indicating that the underlying web resource is no longer accessible; the domain is currently flagged as taken offline. Independent intelligence shows that 15 of 93 security vendors on VirusTotal have flagged the domain as malicious, and the domain appears on one external security blocklist.

PhishDestroy has also added the domain to its blocklist. The page title observed during the brief presence of the site was "Exodus Wallet | Best Crypto Wallet for Desktop & Mobile," directly referencing the Exodus brand. The intelligence tags the activity as a crypto scam and identifies the target brand as Exodus, suggesting a brand‑impersonation campaign aimed at cryptocurrency users. While the exact content of the site at the time of compromise is not captured, the combination of brand‑specific page title, the crypto‑scam classification, and the presence on multiple vendor blocklists provides strong evidence of a targeted impersonation attempt.

Defenders should block the domain and its associated IP address at perimeter and DNS layers, ensure that any outbound connections to the host are denied, and add the domain to internal phishing and malware blocklists. Ongoing monitoring of the AS16509 address space for similar newly created GoDaddy subdomains is recommended, as the infrastructure appears to be leveraged for rapid deployment of impersonation sites.