exodusts[.]com

Analysis of exodusts.com shows a recent registration (May 18 2025) by Gname.com Pte. Ltd. and deployment behind Cloudflare’s network (AS13335) with the IPv6 address 2606:4700:3032::ac43:b855. The domain resolves to Cloudflare’s edge and uses the nameservers aida.ns.cloudflare.com and sonny.ns.cloudflare.com, indicating the infrastructure is fully proxied. A Google Trust Services / WE1 SSL certificate is present, which is typical for Cloudflare‑issued certificates and does not provide authentication of the underlying owner. The page title returned from the site is “OTC Markets”, while the threat profile lists a brand impersonation of Exodus and classifies the activity as a crypto‑scam.

The domain is currently listed as offline, but it has been observed on a single security blocklist and is specifically blocked by PhishDestroy. VirusTotal records show that one of ninety‑five scanning engines flagged the domain, suggesting at least one detection of malicious behavior. Scamadviser assigns a trust score of 31 / 100, reflecting a low reputation. The combination of a brand‑targeted impersonation, a generic financial‑type page title, and the use of Cloudflare’s fastly infrastructure aligns with typical crypto‑scam delivery methods.

What remains uncertain is the exact content that was served before the takedown, as no visual or page‑structure details are available. Defenders should add exodusts.com to outbound filtering rules, monitor DNS queries for the associated Cloudflare IPs, and consider extending blocklist coverage to include the observed nameservers. Continuous re‑scanning with multi‑engine services is advised to capture any future re‑activation, and alerts should be generated for any new domains registered by the same registrar that target the Exodus brand.