exoduswale[.]gitbook[.]io

The domain exoduswale.gitbook.io is a confirmed phishing site engaged in brand impersonation targeting Exodus, a cryptocurrency wallet provider. It presented itself as the legitimate Exodus wallet platform to deceive users into entering sensitive information, specifically through seed phrase phishing. No drainer kit was identified, but the site posed an elevated risk for credential theft. As of the latest verification, exoduswale.gitbook.io has been taken offline.

Technical indicators confirm the malicious nature of exoduswale.gitbook.io. The domain was flagged by 7 of 95 security vendors on VirusTotal, including alphaMountain.ai, BitDefender, and CyRadar. It appeared on one security blocklist, PhishDestroy, and was registered through Cloudflare, Inc. on February 21, 2026. The site resolved to the IPv6 address 2606:4700:4400::6812:282f, hosted by Cloudflare in the US, and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was 'exodus wallet | exodus wallet', reinforcing its attempt to mimic the legitimate Exodus brand. Technologies detected included Cloudflare and HTTP/3.

Users who interacted with exoduswale.gitbook.io should take immediate action to secure their assets and accounts. If seed phrases or private keys were entered, revoke all token approvals, move funds to a new wallet, and monitor for unauthorized transactions. For credential exposure, change passwords on the legitimate Exodus platform, enable two-factor authentication, and watch for signs of fraud. Report the phishing domain to Exodus support, GitBook abuse channels, and platforms like Google Safe Browsing or PhishTank to aid in takedown efforts.