exodus-authorized[.]com

The domain exodus-authorized.com was registered on June 20, 2026 through Internet Domain Service BS Corp. The site presents a page titled “Verification Portal” and returns an HTTP 302 redirect, indicating an attempt to forward visitors to another location. VirusTotal reports 13 of 95 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 / 100, confirming a high‑risk profile. The domain resolves to the IP address 185.92.183.187, which belongs to the AS56971 cloud network hosted in Latvia. Nameservers dns1.icedns.is and dns2.icedns.is are publicly listed, and the server presents a Google Web Server stack with HTTP/3 support, HSTS enforcement, and a Let’s Encrypt certificate (YR1). The same IP and host have been placed on three security blocklists, and the domain is actively blocked by PhishDestroy, MetaMask, and SEAL. Analysis indicates the domain is being used to impersonate the cryptocurrency wallet provider Exodus, likely to lure users into a credential‑harvesting flow. The combination of a verification‑portal title, a redirect response, and the observed blocklist activity aligns with known impersonation campaigns that ask victims to confirm account ownership. However, the exact payload or form fields hosted behind the redirect have not been captured, leaving the precise data‑exfiltration mechanism uncertain. Defenders should add exodus-authorized.com and its resolving IP 185.92.183.187 to deny‑list rules at DNS and network layers, and monitor for any HTTP 302 activity targeting the same endpoint. Continuous scanning of the associated nameservers and certificate transparency logs can reveal future re‑registrations. Users of the Exodus brand should be warned to disregard any unsolicited verification requests that reference this domain, and organizations should employ sandboxing to inspect the final landing page if a redirect is followed.