exodus[.]riverrootriseforest[.]de

This domain, exodus.riverrootriseforest.de, is flagged as a brand impersonation threat specifically targeting Exodus, a widely used cryptocurrency wallet. Analysis indicates the site was designed to deceive users into entering sensitive credentials, likely through a credential-harvesting or wallet-draining mechanism. The domain mimics the legitimate Exodus brand, exploiting user trust to facilitate unauthorized access to digital assets. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on February 21, 2026, through Liquidweb and resolves to the IP address 67.225.132.80. It is detected by 4 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists, including MetaMask, SEAL, and PhishDestroy. The SSL certificate is issued by Let's Encrypt, and the underlying technologies include PHP, AlmaLinux, OpenSSL, and Apache HTTP Server. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to users. However, residual risk remains due to the potential for re-registration or migration to alternative infrastructure. Users who may have interacted with this domain are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the authenticity of any communications claiming to be from Exodus. Organizations should update blocklists and monitor for similar impersonation attempts targeting cryptocurrency platforms.