exodus-start[.]io

Analysis as of July 23, 2026 indicates that the domain exodus-start.io is actively serving content over HTTP with a 200 response code. The site resolves to the IPv4 address 144.31.228.146, which is allocated to AS213877 U1 DIGITAL SERVICES LTD in Germany. Registration was performed through Hosting Concepts B.V. d/b/a Registrar.eu and the domain was created on December 28, 2025. The authoritative name servers are ina1.registrar.eu, ina2.registrar.eu, and ina3.registrar.eu. No TLS certificate is present, meaning the site is only reachable via unencrypted HTTP. The page title returned by the server is “Exodus Wallet – Лучший криптовалютный кошелек”, and the threat classification is listed as Wallet/Seed Phishing with an explicit claim to impersonate the Ethereum brand. Multiple security services have flagged the domain.

VirusTotal reports that 19 of 93 scanning engines label the domain as malicious. Google Safe Browsing categorizes it under social engineering, and the domain appears on one external blocklist. AlienVault OTX references the domain in a single threat‑intel pulse. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. PhishDestroy has already added the domain to its blocklist, indicating that at least one commercial mitigation product is enforcing a block. The evidence suggests a high‑confidence campaign targeting cryptocurrency users, likely aiming to harvest wallet seeds or private keys.

The lack of SSL, combined with the Russian‑language page title, may be intended to lure non‑English‑speaking users. While the page content has not been inspected directly, the combination of brand impersonation, phishing classification, and the observed infrastructure points to a credential‑stealing operation. Defenders should immediately block exodus-start.io at DNS and web‑filter layers, deny traffic to its hosting IP 144.31.228.146, and add the associated name servers to watch lists.