encrypted-exodus[.]com

Analysis indicates that the domain encrypted-exodus.com was registered on February 21, 2026 through Internet Domain Service BS Corp and uses the parkingcrew.net name servers (ns1.parkingcrew.net, ns2.parkingcrew.net). The site returns HTTP 200 responses but presents no TLS certificate, meaning traffic is unencrypted. Passive DNS shows the domain resolving to IP address 104.247.81.99, which is advertised as belonging to Next Dimension Inc in Canada. The hosting infrastructure is not associated with any known benign services and the IP appears on a single security blocklist.

Threat intelligence sources have flagged the domain as a crypto‑related scam that masquerades as the Exodus brand; the page title is simply “encrypted‑exodus.com”, providing no additional context. AlienVault OTX lists the domain in one pulse, and the commercial blocklist PhishDestroy currently blocks it. VirusTotal scans have returned 16 positive detections out of 91 scanners, confirming that multiple security vendors consider the site malicious. The domain is currently listed as active, and no SSL/TLS certificate is present, increasing the risk of credential capture or malicious redirects.

While the exact payload or phishing page content has not been publicly released, the convergence of registrar age, lack of encryption, positive VirusTotal detections, and inclusion on reputable blocklists strongly suggests a high‑risk operation targeting Exodus users seeking cryptocurrency services. Defenders should add the domain and its resolving IP to deny‑list rules, monitor DNS queries for the name servers, and ensure that any internal security gateways block traffic to the IP. Incident response teams should also advise users to avoid any unsolicited communications that reference Exodus and to verify URLs through official channels. Ongoing monitoring of the IP reputation and periodic rescanning of the domain are recommended to detect any changes in behavior.