exodus-home-cdn[.]dora[.]run

Analysis of exodus-home-cdn.dora.run shows a recently registered domain (created February 21, 2026) that targets the Exodus brand through a crypto‑related impersonation scheme. The site’s page title, "Exodus® Web3 Wallet | Multichain™ Web3* Wallet©," explicitly references the Exodus Web3 wallet, confirming the brand‑impersonation intent. Infrastructure evidence indicates the domain is hosted on Amazon Web Services, resolving to the IP address 52.223.42.255, which belongs to the Amazon.com, Inc. ASN16509 network in the United States. The SSL certificate presented is an Amazon‑issued RSA 2048‑bit certificate (Amazon RSA 2048 M03), providing a legitimate‑looking HTTPS appearance but offering no assurance of legitimacy.

The domain is registered through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and uses three AWS name servers (ns-1255.awsdns-28.org, ns-990.awsdns-59.net, ns-114.awsdns-14.com). Security telemetry shows the domain is listed on three separate blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft’s trust score is 0 out of 100, reinforcing the malicious classification. VirusTotal scans report two of ninety‑five security vendors flagging the domain, providing independent confirmation of suspicious activity.

The site is currently reported as offline, which may be a temporary takedown or an evasion tactic. Defenders should continue to enforce blocklist entries, monitor for any re‑hosting attempts, and educate users that any unsolicited requests referencing the Exodus Web3 wallet from this domain are fraudulent. Additional scrutiny of traffic to the IP 52.223.42.255 and the associated AWS resources is advised, and any future reappearance should be treated as high‑risk brand impersonation.