exodus-v2[.]com

The domain exodus-v2.com is identified as a brand impersonation threat specifically targeting Exodus, a cryptocurrency wallet provider. This domain is designed to deceive users into believing it is an official Exodus platform, potentially leading to credential theft, financial fraud, or unauthorized access to digital assets. As of the latest analysis, the domain is currently offline, though its prior activity warrants continued monitoring. Analysis of exodus-v2.com reveals multiple technical indicators of malicious intent. The domain was flagged by 11 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its suspicious nature. It was registered on July 10, 2025, through Gransy, s.r.o., and resolves to the IP address 190.115.24.11, hosted under AS59692 (IQWeb FZ-LLC) in Belize. The domain appears on one security blocklist and lacks an SSL certificate, further reducing its legitimacy. The page title, 'Website 190.115.24.11 is ready. The content is to be added,' suggests the site was either in development or intentionally left incomplete to evade detection. The current status of exodus-v2.com is offline, but organizations and users should remain vigilant. Given the domain's history of brand impersonation and the elevated risk it poses, it is recommended to block the domain and its associated IP (190.115.24.11) at the network level. Users who may have interacted with the domain should immediately revoke any credentials or session tokens associated with Exodus or other cryptocurrency services. Additionally, monitoring for phishing attempts referencing this domain is advised, as threat actors may attempt to reuse the infrastructure or domain name in future campaigns.