ex0dus[.]app

This domain is flagged as an active, high-risk brand impersonation threat designed to deceive users in the cryptocurrency ecosystem. Analysis indicates the infrastructure is specifically crafted to mimic the 'across' brand, presenting itself as a gambling platform with a page title of '1win - Sports Betting & Casino | 500% Bonus Up to $1,500'. The domain exhibits multiple red flags consistent with malicious intent, including a suspiciously recent creation date of February 23, 2026, and a registration through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 172.67.215.59, hosted on Cloudflare's network (AS13335) in the United States. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend superficial legitimacy. The combination of brand impersonation, fake promotional offers, and Cloudflare hosting suggests an attempt to evade detection while targeting users with fraudulent financial incentives. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should update endpoint protection rules to detect and prevent access to the domain, particularly in environments where cryptocurrency-related activities occur. Users should be educated to recognize brand impersonation tactics, such as unrealistic bonus offers (e.g., 500% bonuses) and mismatched domain names. Security teams are advised to monitor for additional domains registered through NiceNIC or resolving to the same IP, as these may indicate related malicious infrastructure. Verification of SSL certificates alone is insufficient, as threat actors frequently abuse legitimate certificate authorities.