exoduapp[.]com

The domain exoduapp.com was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (ASN 13335) with the public address 104.21.39.51 located in the United States. The site presented the page title “编组 21” and used a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection. Reputation data is uniformly negative: VirusTotal recorded 13 detections out of 93 scanned engines, Google Safe Browsing classified the site as a social‑engineering threat, and three independent blocklists have listed the domain. Additional security‑rating services reflect the same assessment, with Gridinsoft assigning a trust score of 0 out of 100.

The domain is also flagged by PhishDestroy, MetaMask and SEAL, confirming that multiple anti‑phishing ecosystems consider it malicious. Infrastructure analysis shows the domain resolves to Cloudflare’s edge nodes using the authoritative nameservers lia.ns.cloudflare.com and venkat.ns.cloudflare.com, and the service is delivering content over HTTP/3. The observed behavior aligns with a brand‑impersonation campaign targeting the cryptocurrency wallet provider Exodus, as indicated by the “Impersonates: Exodus” tag in the intelligence feed.

At the time of this report the site has been taken offline, but the historical footprint suggests it was actively serving malicious content before removal. Defenders should continue to block exoduapp.com at perimeter and DNS layers, monitor for any re‑hosting attempts on other Cloudflare‑protected domains, and update endpoint protection rules to include the observed VirusTotal signatures. Because the site used a legitimate Google certificate, static certificate pinning may be ineffective; threat‑intel sharing of the domain’s IP address, nameserver configuration, and detection identifiers is recommended to accelerate detection across collaborative networks.