walletv3[.]com

walletv3.com was observed hosting a page with the title “Exodus” and is classified as a crypto‑scam that impersonates the Exodus wallet brand. The domain was created on 27 November 2025 and is registered through Web Commerce Communications Limited. DNS resolution points to IP 185.221.215.64, which belongs to AS62082 Hostland LTD in Russia. No TLS certificate is presented, indicating that the site was served over plain HTTP.

The authoritative nameservers are a.dnspod.com, b.dnspod.com and c.dnspod.com, commonly used by fast‑flux and disposable registrations. Threat intelligence services have flagged the domain: twelve of ninety‑five VirusTotal scanners reported malicious activity, and Gridinsoft assigned a trust score of 0 / 100. The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt and Codeesura—demonstrating consensus among multiple mitigations. The current operational status is “offline,” suggesting that the malicious content has been taken down or the hosting was disrupted.

Analysis confirms that the domain directly targets users of the Exodus cryptocurrency wallet by mimicking its brand in the page title, fulfilling the criteria for brand‑impersonation scams. No additional indicators such as malicious payload hashes, C2 infrastructure, or phishing form details are available from the provided data, leaving the exact content of the compromised page unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any re‑use, and update detection signatures to include the identified nameservers and registrar information. Incident response teams should also advise Exodus users to verify URLs before entering credentials and to treat any unsolicited communications referencing walletv3.com as malicious.