helpcenter-exodus[.]vercel[.]app

helpcenter-exodus.vercel.app is a newly registered domain that mimics the Exodus brand. The zone was created on 21 February 2026 and is hosted on Amazon’s AS16509 infrastructure, resolving to the IPv4 address 216.198.79.3 located in the United States. DNS resolution shows the site served through Vercel, and the TLS handshake presents a certificate issued by Google Trust Services under the WR1 intermediate, indicating a valid‑looking HTTPS configuration. HTTP requests return status code 451, and the only visible page title is “Deployment Unavailable”, which suggests the front‑end has been taken down. The domain is listed on a single security blocklist and has been flagged by PhishDestroy as offline.

VirusTotal analysis reports that 17 of 93 scanning engines raise a detection, reinforcing the suspicion of malicious intent. The registrar is Tucows Domains Inc., a common registrar for disposable or short‑lived malicious sites. Technologies identified include Vercel and HTTP Strict Transport Security (HSTS), which are typical for legitimate web applications but can also be leveraged to lend credibility to fraudulent pages. The primary indicator is the explicit impersonation of the Exodus brand, a cryptocurrency wallet service, combined with the “Crypto Scam” classification. While the page content is currently unavailable, the combination of recent registration, rapid deployment on a cloud platform, and the presence of a Google‑issued certificate are consistent with fast‑flux or copy‑cat campaigns that aim to harvest credentials or lure victims into fraudulent transactions.

Uncertainty remains around the exact payload or phishing workflow because the site no longer serves content, and no additional URLs or assets have been observed. Defenders should block any network traffic to 216.198.79.3 and add the domain to URL filtering policies that target brand‑impersonation threats. Monitoring for DNS queries to helpcenter‑exodus.vercel.