exodus-backupcenter[.]vercel[.]app

The domain exodus-backupcenter.vercel.app was observed on July 23, 2026 and is classified as a brand‑impersonation crypto scam targeting the Exodus cryptocurrency wallet. The site resolves to the IP address 64.29.17.131, which is announced by AS16509 Amazon.com, Inc. and geolocated to the United States. Hosting is provided through Vercel, as indicated by the detected technology stack, and the service presents an HSTS header, confirming the use of HTTPS. The presented SSL certificate is issued by Google Trust Services under the WR1 intermediate, further confirming a valid TLS termination on the Vercel platform. A HTTP request to the domain returns status code 451, indicating that the content is unavailable for legal reasons, and the page title returned by the server is “Deployment Unavailable”.

The domain was registered on February 21, 2026 through Tucows Domains Inc., and the registrar information matches the public WHOIS record. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 15 of 93 scanning engines have flagged the domain as malicious, providing independent corroboration of the phishing classification. The overall risk rating is elevated, reflecting the combination of brand impersonation, crypto‑related lure, and the presence of multiple vendor detections.

Defenders should add the domain and its associated IP address to outbound and inbound deny lists, enforce DNS sink‑holing where possible, and monitor for any related subdomains that may be created under the same registrar or Vercel account. Because the site is currently offline, continuous re‑verification is recommended in case the adversary re‑hosts the payload on a new Vercel instance. Attribution to the Exodus brand is confirmed by the explicit brand target field, but the exact phishing kit or credential‑capture mechanism remains unknown, as the page content was not retrieved.