exodus[.]com[.]merge[.]guivalmex[.]com[.]mx

This domain, exodus.com.merge.guivalmex.com.mx, poses a specific brand impersonation threat against Exodus, designed to deceive users into believing they are accessing legitimate Exodus services. The domain structure mimics official Exodus URLs, and the presence of an Apache HTTP Server with a default Index of / page indicates a potential file directory exposure, which could be used to host fraudulent download links or credential harvesting forms. Although currently offline, its infrastructure was configured for malicious activities targeting cryptocurrency users.

Technical analysis reveals the domain was registered on February 21, 2026, through AKKY ONLINE SOLUTIONS, S.A. DE C.V., a registrar with known abuse history. VirusTotal data shows 4 out of 95 security vendors flagged this domain as malicious, and it appears on 3 security blocklists. The SSL certificate issued by Let's Encrypt further lowers trust, as such certificates are commonly used for phishing. The Gridinsoft trust score of 0/100 confirms high risk, and the domain resolves to IP 67.23.231.170, which may host additional threats.

Users who visited this domain should immediately scan their devices for malware and change all passwords, especially for Exodus and associated cryptocurrency wallets. Monitor financial accounts for unauthorized transactions, as brand impersonation domains often attempt to steal login credentials or private keys. Enable two-factor authentication on all accounts and report any suspicious activity to relevant cybersecurity authorities. Avoid revisiting the domain or similar suspicious URLs in the future.